polyc-query 2026.8.3

//! Catalog table/view name constants for [`super::QueryEngine::build`].
//!
//! Pure naming — no registration logic lives here; see the `engine` module
//! docs for the catalog-scoping rules these names participate in.

#[allow(unused_imports)] // only used by intra-doc links above
use super::QueryEngine;
#[allow(unused_imports)] // only used by intra-doc links above
use crate::session::QueryScope;

/// Name of the raw wide-table registration.
///
/// `events` (see module docs) is built from this table. Present in the
/// catalog only for [`QueryScope::Fleet`]; every other scope deregisters it
/// immediately after [`QueryEngine::build`] builds the view.
pub(crate) const EVENTS_RAW_TABLE: &str = "events_raw";

/// Name of the always-registered committed-turns view — the query layer's
/// default surface for every scope.
pub(crate) const EVENTS_VIEW: &str = "events";

/// Name of the raw typed-`usage` registration, carrying every `usage` row
/// [`crate::decode::usage::schema`] decodes, uncommitted/orphaned turns
/// included.
///
/// [`USAGE_TABLE`] (see below) is built from this table — mirroring
/// [`ATTRIBUTION_RAW_TABLE`]/[`ATTRIBUTION_TABLE`]'s raw-table/view split,
/// though for a committed-turn filter rather than an identity redaction.
/// Present in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `usage` view — see `crate::views`'s module docs' "Committed-turn filter
/// invariant" section.
pub(crate) const USAGE_RAW_TABLE: &str = "usage_raw";

/// Name of the typed `usage` view, registered for every scope with
/// IDENTICAL columns (no identity/signer-key redaction applies to `usage`)
/// but filtered to committed turns only — see `crate::views`'s module docs'
/// "Committed-turn filter invariant" section for the mechanism.
pub(crate) const USAGE_TABLE: &str = "usage";

/// Name of the raw typed-`model_call` registration — see
/// [`USAGE_RAW_TABLE`]'s doc for why `model_call`, like `usage`, needs this
/// raw/view split for the committed-turn filter (not for identity
/// redaction).
pub(crate) const MODEL_CALL_RAW_TABLE: &str = "model_call_raw";

/// Name of the typed `model_call` view, registered for every scope with
/// IDENTICAL columns, filtered to committed turns only — see
/// [`USAGE_TABLE`]'s doc for why `model_call`, like `usage`, is safe outside
/// [`QueryScope::Fleet`] once committed-turn filtered.
pub(crate) const MODEL_CALL_TABLE: &str = "model_call";

/// Name of the raw typed-`turn_failed` registration, carrying every
/// `turn_failed` row [`crate::decode::turn_failed::schema`] decodes,
/// uncommitted/orphaned turns included.
///
/// [`TURN_FAILED_TABLE`] (see below) is built from this table — mirroring
/// [`USAGE_RAW_TABLE`]/[`USAGE_TABLE`]'s raw-table/view split, for the
/// identical committed-turn-filter reason. Present in the catalog only for
/// [`QueryScope::Fleet`]; every other scope deregisters it immediately after
/// [`QueryEngine::build`] builds the `turn_failed` view — see
/// `crate::views`'s module docs' "Committed-turn filter invariant" section.
pub(crate) const TURN_FAILED_RAW_TABLE: &str = "turn_failed_raw";

/// Name of the typed `turn_failed` view, registered for every scope with
/// IDENTICAL columns (no identity/signer-key redaction applies to
/// `turn_failed`, same as [`USAGE_TABLE`]) but filtered to committed turns
/// only — see `crate::views`'s module docs' "Committed-turn filter
/// invariant" section for the mechanism.
///
/// A turn failure is within-conversation data (never spans conversations)
/// and carries no external identity, so it is safe outside
/// [`QueryScope::Fleet`] the same way `usage`/`model_call` are; see
/// [`crate::decode::turn_failed`]'s module docs. `turn_failed` is NOT exempt
/// from the committed-turn filter [`USAGE_TABLE`]/[`MODEL_CALL_TABLE`] carry
/// — a prior review pass exempted it on the theory that a failed turn never
/// carries a `turn_complete` marker by construction, but that theory is
/// false: the control plane's sole `turn_failed` emission
/// (`crates/control-plane/src/grpc/mod.rs`) pushes the optional
/// `turn_failed` event and then pushes `turn_complete` UNCONDITIONALLY, in
/// the SAME atomic batch — the durable sibling relationship that module's
/// own comment documents. A normally-failed turn therefore carries BOTH
/// markers and stays visible through the semijoin below; only an
/// orphaned/uncommitted `turn_failed` row (the partial-append crash window,
/// same as every other typed table) is hidden.
pub(crate) const TURN_FAILED_TABLE: &str = "turn_failed";

/// Name of the raw typed-`summary` registration, carrying every `summary`
/// row [`crate::decode::summary::schema`] decodes.
///
/// [`SUMMARY_TABLE`] (see below) is built from this table ONLY for
/// [`QueryScope::Fleet`] — unlike every raw/view pair above, no view is
/// created for any other scope at all, so the name `summary` itself is
/// unresolvable outside Fleet, the same "never even registered" posture
/// [`PERSONAS_TABLE`]/[`PARTICIPATIONS_TABLE`] use (see the module docs'
/// "Reference data" section), not the "resolvable but redacted" posture
/// `attribution`/`payments`/... use. `summary_raw` itself is deregistered
/// for every non-Fleet scope exactly like every other `*_raw` table.
pub(crate) const SUMMARY_RAW_TABLE: &str = "summary_raw";

/// Name of the typed `summary` view, registered ONLY for
/// [`QueryScope::Fleet`] — a persona/conversation-scoped session must never
/// see summary content (the intent behind this Fleet-only gate; see
/// `crate::views`'s module docs' "Committed-turn filter invariant" section
/// for why `summary` is scoped this way rather than committed-turn filtered
/// like [`USAGE_TABLE`]/[`MODEL_CALL_TABLE`]: its own `turn_id` is a
/// synthetic tag, never a real turn's id, which makes the usual
/// committed-turn semijoin meaningless for this table specifically).
///
/// [`crate::decode::summary`]'s module docs cover the `covers_through_position`
/// caveat: a consumer wanting the transcript's summary cutoff keys on this
/// table's own `position` column, never on `covers_through_position`.
pub(crate) const SUMMARY_TABLE: &str = "summary";

/// Name of the raw typed-`fires` registration, carrying every `fires` row
/// [`crate::decode::fires::schema`] decodes.
///
/// [`FIRES_TABLE`] (see below) is built from this table for
/// [`QueryScope::Fleet`] (every row) and, as of issue #1882, for a
/// persona-scoped session (rows belonging to the caller's OWN routines
/// only, via the join described on [`FIRES_TABLE`]'s own doc) — never for a
/// conversation-grant session, which carries no caller persona to own
/// anything. `fires_raw` itself is deregistered for a conversation-grant
/// scope exactly like every other `*_raw` table, but stays registered for a
/// persona-scoped scope so the owner-filtered view above can resolve
/// against it.
pub(crate) const FIRES_RAW_TABLE: &str = "fires_raw";

/// Name of the typed `fires` view — the routine scheduler's decoded
/// `routine_fired` markers (issue #1592's fire-history source).
///
/// Registered for [`QueryScope::Fleet`] (every row, unfiltered — see
/// [`crate::views::FIRES_VIEW_SQL`]) and, as of issue #1882, for a
/// persona-scoped session, joined against [`ROUTINES_TABLE`] on `routine =
/// routines.name` ([`crate::views::FIRES_OWNED_VIEW_SQL`]) — since
/// [`ROUTINES_TABLE`] is itself already filtered to that persona's own
/// routines for that scope, the join carries the row-level owner filter
/// with no separate `WHERE creator_persona = ...` clause needed. Never
/// registered for a conversation-grant scope, which resolves no caller
/// persona to own anything. See [`crate::decode::fires`]'s module docs for
/// why `fires`' one source partition needed a narrow, additional admission
/// (`crate::authority`'s module doc, "Admitting the scheduler partition")
/// to make this possible for a persona scope at all.
pub(crate) const FIRES_TABLE: &str = "fires";

/// Name of the `routines` reference table — registered for
/// [`QueryScope::Fleet`] (every routine) and, as of issue #1882, for a
/// persona-scoped session (rows whose `creator_persona` equals the caller's
/// own persona id only) — never for a conversation-grant scope, which
/// resolves no caller persona to own anything. Every other reference table
/// ([`PERSONAS_TABLE`]/[`PARTICIPATIONS_TABLE`]/...) keeps the Fleet-only
/// posture the module docs' "Reference data" section describes; `routines`
/// is the one exception, because routine ownership (`creator_persona`) now
/// exists as a first-class row filter the way `attribution`'s `persona_id`
/// already does for other tables, and the trust boundary here is
/// member↔member, not member↔fleet — an admin legitimately sees every
/// member's routines, but a member's own routines are exactly their own to
/// begin with. Decoded from the caller-supplied
/// [`crate::routine_catalog::RoutineStatusRecord`] list
/// ([`crate::engine::ReferenceData::routines`], already filtered to the
/// caller's own rows by `crate::authority::ScopedQuery::resolve_routines`
/// for a persona scope), never a journal kind (issue #1592). #1593 extends
/// the decoded record with provenance/pause/schedule spec fields — see
/// [`crate::routine_catalog::RoutineStatusRecord`]'s own doc.
pub(crate) const ROUTINES_TABLE: &str = "routines";

/// Name of the raw typed-`turn_dispatch` registration, carrying every
/// `turn_dispatch` row [`crate::decode::turn_dispatch::schema`] decodes,
/// uncommitted/orphaned turns included.
///
/// [`TURN_DISPATCH_TABLE`] (see below) is built from this table — mirroring
/// [`USAGE_RAW_TABLE`]/[`USAGE_TABLE`]'s raw-table/view split, for the
/// identical committed-turn-filter reason (issue #1593).
pub(crate) const TURN_DISPATCH_RAW_TABLE: &str = "turn_dispatch_raw";

/// Name of the typed `turn_dispatch` view, registered for every scope with
/// IDENTICAL columns (no identity on this table, same as [`USAGE_TABLE`])
/// but filtered to committed turns only — see [`USAGE_TABLE`]'s doc for the
/// mechanism. Joins to [`FIRES_TABLE`] by `occurrence`, the routines
/// explorer page's fire-history-to-turns link (issue #1593) — see
/// [`crate::decode::turn_dispatch`]'s module docs.
pub(crate) const TURN_DISPATCH_TABLE: &str = "turn_dispatch";

/// Name of the raw typed-`routine_lifecycle` registration, carrying the raw
/// `signer_public_key` column [`crate::decode::routine_lifecycle::schema`]
/// decodes.
///
/// [`ROUTINE_LIFECYCLE_TABLE`] (see below) is built from this table ONLY for
/// [`QueryScope::Fleet`] — the same "never even registered outside Fleet"
/// posture [`FIRES_RAW_TABLE`] uses, for the identical underlying reason:
/// this table's one source partition (`"routine-scheduler"`) is itself
/// admitted into replay only for a Fleet scope (issue #1593).
pub(crate) const ROUTINE_LIFECYCLE_RAW_TABLE: &str = "routine_lifecycle_raw";

/// Name of the typed `routine_lifecycle` view, registered ONLY for
/// [`QueryScope::Fleet`] — the routine scheduler's decoded lifecycle audit
/// events (created/paused/resumed/deleted), the routines explorer page's
/// per-routine lifecycle timeline source (issue #1593). See
/// [`crate::decode::routine_lifecycle`]'s module docs and [`FIRES_TABLE`]'s
/// doc for why this table follows `fires`'s Fleet-only-gate shape.
pub(crate) const ROUTINE_LIFECYCLE_TABLE: &str = "routine_lifecycle";

/// Name of the raw typed-`routine_setup` registration, carrying every
/// `routine_setup` row that [`crate::decode::routine_setup::schema`]
/// decodes.
///
/// [`ROUTINE_SETUP_TABLE`] (see below) is built from this table — the same
/// raw-table/view split and scope posture [`FIRES_RAW_TABLE`] uses:
/// registered for every scope during `build`, the view built for
/// [`QueryScope::Fleet`] (unfiltered) and for a routine-owning
/// persona-scoped session (owner-filtered join), then the raw name
/// deregistered for every non-Fleet scope so a persona session cannot route
/// around the owner filter.
pub(crate) const ROUTINE_SETUP_RAW_TABLE: &str = "routine_setup_raw";

/// Name of the typed `routine_setup` view — the scheduler's decoded
/// `routine_setup_completed` markers: one row per routine whose
/// attended setup rehearsal reached a terminal, fully-resolved state.
///
/// Registered for [`QueryScope::Fleet`] (every row, unfiltered —
/// [`crate::views::ROUTINE_SETUP_VIEW_SQL`]) and for a routine-owning
/// persona-scoped session (rows belonging to the caller's OWN routines only,
/// via the same uid-keyed join against [`ROUTINES_TABLE`] that
/// [`FIRES_TABLE`] uses — [`crate::views::ROUTINE_SETUP_OWNED_VIEW_SQL`]);
/// never for a conversation-grant scope.
pub(crate) const ROUTINE_SETUP_TABLE: &str = "routine_setup";

/// Name of the `routine_grants` view — the durable routine-fire
/// tool-grant LEDGER: every `approval_response` carrying the
/// `routine_grant` marker in a routine's fire conversation, joined to the
/// routine it governs via [`ROUTINES_TABLE`]'s `fire_conversation_id`
/// column. Grants, revocations (a disapproving record), and blanket-mode
/// records all appear; latest-wins folding is [`ROUTINE_ACTIVE_GRANTS_TABLE`]'s
/// job. Registered for [`QueryScope::Fleet`] and a routine-owning
/// persona-scoped session with ONE body
/// ([`crate::views::ROUTINE_GRANTS_VIEW_SQL`]): the join against the
/// already-scope-filtered `routines` table IS the row filter, exactly the
/// `FIRES_OWNED_VIEW_SQL` mechanism. Never registered for a
/// conversation-grant scope.
pub(crate) const ROUTINE_GRANTS_TABLE: &str = "routine_grants";

/// Name of the `routine_active_grants` view — the latest-wins
/// fold over [`ROUTINE_GRANTS_TABLE`], keeping only keys whose LATEST
/// record approves: the SQL mirror of the control plane's own
/// `collect_routine_tool_grants` fold (per-tool keys, blanket scopes
/// collapsed onto one key, a latest disapproving record removing its key).
/// Same scope posture as [`ROUTINE_GRANTS_TABLE`].
pub(crate) const ROUTINE_ACTIVE_GRANTS_TABLE: &str = "routine_active_grants";

/// Name of the `routine_overview` view — the per-routine
/// aggregate: one row per routine composing [`ROUTINES_TABLE`],
/// [`FIRES_RAW_TABLE`], [`ROUTINE_ACTIVE_GRANTS_TABLE`],
/// [`ROUTINE_SETUP_RAW_TABLE`], and the fire conversation's approval
/// request/response pairs into fire counts, the derived grant mode, active
/// grant count, unattended denial count, pending setup approvals, and setup
/// state. A composition over the typed tables only — never a second read
/// path (see [`crate::views::ROUTINE_OVERVIEW_VIEW_SQL`]'s doc). Same scope
/// posture as [`ROUTINE_GRANTS_TABLE`].
pub(crate) const ROUTINE_OVERVIEW_TABLE: &str = "routine_overview";

/// Name of the raw typed-`attribution` registration, carrying every
/// `identity_*` column [`crate::decode::attribution::schema`] decodes.
///
/// [`ATTRIBUTION_TABLE`] (see below) is built from this table — mirroring
/// [`EVENTS_RAW_TABLE`]/[`EVENTS_VIEW`]'s raw-table/view split. Present in
/// the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `attribution` view — see the module docs' "Identity redaction invariant"
/// section.
pub(crate) const ATTRIBUTION_RAW_TABLE: &str = "attribution_raw";

/// Name of the `attribution` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (`identity_provider, identity_scope, identity_external_id,
/// identity_display_name` included) for [`QueryScope::Fleet`], a REDACTED
/// projection (uniform keys plus the resolved `persona_id`/`role`, no
/// `identity_*` columns) for every other scope — see the module docs'
/// "Identity redaction invariant" section for the mechanism.
pub(crate) const ATTRIBUTION_TABLE: &str = "attribution";

/// Name of the raw typed-`payments` registration, carrying the raw
/// `signer_public_key` column [`crate::decode::payments::schema`] decodes.
///
/// [`PAYMENTS_TABLE`] (see below) is built from this table — mirroring
/// [`ATTRIBUTION_RAW_TABLE`]/[`ATTRIBUTION_TABLE`]'s raw-table/view split.
/// Present in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `payments` view — see the module docs' "Payment signer-key redaction
/// invariant" section.
pub(crate) const PAYMENTS_RAW_TABLE: &str = "payments_raw";

/// Name of the `payments` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (`signer_public_key` included) for [`QueryScope::Fleet`], a
/// REDACTED projection (every other column, no `signer_public_key`) for
/// every other scope — see the module docs' "Payment signer-key redaction
/// invariant" section.
pub(crate) const PAYMENTS_TABLE: &str = "payments";

/// Name of the raw typed-`refusals` registration, carrying the raw
/// `signer_public_key` column [`crate::decode::refusals::schema`] decodes
/// (`#2090`, INV-W5).
///
/// [`REFUSALS_TABLE`] (see below) is built from this table — mirroring
/// [`PAYMENTS_RAW_TABLE`]/[`PAYMENTS_TABLE`]'s raw-table/view split. Present
/// in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `refusals` view — see [`crate::decode::refusals`]'s module docs'
/// "Redaction" section.
pub(crate) const REFUSALS_RAW_TABLE: &str = "refusals_raw";

/// Name of the `refusals` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (`signer_public_key` included) for [`QueryScope::Fleet`], a
/// REDACTED projection (every other column, no `signer_public_key`) for
/// every other scope — the same mechanism [`PAYMENTS_TABLE`] uses.
///
/// **Committed-turn filter: deliberate exception, not applied.** Every
/// scope-dependent view above joins its `*_raw` table against the committed
/// `events` view (`crate::views`'s module docs' "Committed-turn filter
/// invariant" section) so an orphaned/uncommitted turn's side effects stay
/// invisible. `refusals` does NOT: a payment refusal can happen in a turn
/// that never commits (the proxy rejects the payment, and the turn crashes
/// before its `turn_complete` marker lands), and hiding that refusal behind
/// the committed-turn filter would defeat the whole point of this table —
/// INV-W5's forensics/incident-review purpose is exactly to surface a
/// refusal even when the turn around it never finished. This is a
/// DIFFERENT rationale from [`SUMMARY_TABLE`]'s exemption (that table's
/// `turn_id` is a synthetic tag, not a real turn's id, so the filter would
/// be meaningless rather than merely undesired) — `refusals.turn_id` IS the
/// real refused turn's id, and the filter is skipped on purpose, not because
/// it cannot apply. See [`polyc_proto::kinds::PAYMENT_REFUSAL`]'s own doc for
/// the write-side placement (its OWN atomic batch, at the reject site) that
/// makes this exception sound: every `payment_refusal` event is durable the
/// instant the proxy rejects, whether or not the surrounding turn ever
/// commits.
pub(crate) const REFUSALS_TABLE: &str = "refusals";

/// Name of the raw typed-`wallet_link_lifecycle` registration, carrying the
/// raw `signer_public_key` column
/// [`crate::decode::wallet_link_lifecycle::schema`] decodes (`#2123`).
///
/// [`WALLET_LINK_LIFECYCLE_TABLE`] (see below) is built from this table —
/// mirroring [`REFUSALS_RAW_TABLE`]/[`REFUSALS_TABLE`]'s raw-table/view
/// split. Present in the catalog only for [`QueryScope::Fleet`]; every other
/// scope deregisters it immediately after [`QueryEngine::build`] builds the
/// `wallet_link_lifecycle` view — see
/// [`crate::decode::wallet_link_lifecycle`]'s module docs' "Redaction"
/// section.
pub(crate) const WALLET_LINK_LIFECYCLE_RAW_TABLE: &str = "wallet_link_lifecycle_raw";

/// Name of the `wallet_link_lifecycle` view, registered for every scope with
/// SCOPE-DEPENDENT columns (`#2123`).
///
/// The full row (`signer_public_key` included) for
/// [`QueryScope::Fleet`], a REDACTED projection (every other column, no
/// `signer_public_key`) for every other scope — the same mechanism
/// [`REFUSALS_TABLE`] uses.
///
/// **Committed-turn filter: structurally inapplicable, not applied.** Every
/// `wallet_link_lifecycle` event is appended BARE — no turn tag at all, ever
/// (see [`polyc_proto::kinds::WALLET_LINK_LIFECYCLE`]'s own doc: a
/// wallet-link ceremony redeems from a browser POST outside any turn) — so
/// `turn_id` is always `NULL` for every row this table decodes. A
/// committed-turn `WHERE EXISTS` semijoin against `events.turn_id` would
/// therefore drop every row unconditionally, not filter anything
/// meaningfully. This is a THIRD, distinct rationale from both
/// [`REFUSALS_TABLE`]'s exemption (a real turn id, filter deliberately
/// skipped because the refusal must survive an uncommitted turn) and
/// `SUMMARY_TABLE`'s exemption (a synthetic turn tag the filter would be
/// meaningless against) — stated here explicitly so a later reviewer does
/// not "fix" this table by adding a filter that can only ever return zero
/// rows.
pub(crate) const WALLET_LINK_LIFECYCLE_TABLE: &str = "wallet_link_lifecycle";

/// Name of the raw typed-`messages` registration, carrying every
/// `messages` row [`crate::decode::message_content::messages_schema`]
/// decodes, `internal_only = true` rows included.
///
/// [`MESSAGES_TABLE`] (see below) is built from this table — mirroring
/// [`ATTRIBUTION_RAW_TABLE`]/[`ATTRIBUTION_TABLE`]'s raw-table/view split.
/// Present in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `messages` view — see the module docs' "Message-content redaction
/// invariant" section.
pub(crate) const MESSAGES_RAW_TABLE: &str = "messages_raw";

/// Name of the `messages` view, registered for every scope with a
/// SCOPE-DEPENDENT ROW set.
///
/// Every row for [`QueryScope::Fleet`], every row EXCEPT
/// `internal_only = true` for every other scope — see the module docs'
/// "Message-content redaction invariant" section for the mechanism.
pub(crate) const MESSAGES_TABLE: &str = "messages";

/// Name of the raw typed-`tool_calls` registration, carrying every
/// `tool_calls` row [`crate::decode::message_content::tool_calls_schema`]
/// decodes, `internal_only = true` rows included.
///
/// [`TOOL_CALLS_TABLE`] (see below) is built from this table — the same
/// raw-table/view split [`MESSAGES_RAW_TABLE`] uses. Present in the catalog
/// only for [`QueryScope::Fleet`]; every other scope deregisters it
/// immediately after [`QueryEngine::build`] builds the `tool_calls` view —
/// see the module docs' "Message-content redaction invariant" section.
pub(crate) const TOOL_CALLS_RAW_TABLE: &str = "tool_calls_raw";

/// Name of the `tool_calls` view, registered for every scope with a
/// SCOPE-DEPENDENT ROW set — the same rule [`MESSAGES_TABLE`] follows.
pub(crate) const TOOL_CALLS_TABLE: &str = "tool_calls";

/// Name of the raw typed-`approvals` registration, carrying every Fleet-only
/// column [`crate::decode::approvals::schema`] decodes (`signer_public_key`,
/// `request_reason`, `request_sandbox_mode`, `modified_args_json`,
/// `approved_for_session`, `caller`, `approver`, `response_sandbox_mode`,
/// `injected_context` included).
///
/// [`APPROVALS_TABLE`] (see below) is built from this table — mirroring
/// [`PAYMENTS_RAW_TABLE`]/[`PAYMENTS_TABLE`]'s raw-table/view split. Present
/// in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `approvals` view — see [`crate::decode::approvals`]'s module docs'
/// "Column selection and redaction" section.
pub(crate) const APPROVALS_RAW_TABLE: &str = "approvals_raw";

/// Name of the `approvals` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (every Fleet-only column included) for
/// [`QueryScope::Fleet`], a REDACTED projection (the participant-visible
/// subset [`crate::decode::approvals`]'s module docs name) for every other
/// scope — see that module's "Column selection and redaction" section for
/// the mechanism.
pub(crate) const APPROVALS_TABLE: &str = "approvals";

/// Name of the raw typed-`handoffs` registration, carrying the raw
/// `signed_by` column [`crate::decode::handoffs::schema`] decodes.
///
/// [`HANDOFFS_TABLE`] (see below) is built from this table — mirroring
/// [`PAYMENTS_RAW_TABLE`]/[`PAYMENTS_TABLE`]'s raw-table/view split. Present
/// in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `handoffs` view — see [`crate::decode::handoffs`]'s module docs'
/// "Redaction" section.
pub(crate) const HANDOFFS_RAW_TABLE: &str = "handoffs_raw";

/// Name of the `handoffs` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (`signed_by` included) for [`QueryScope::Fleet`], a
/// REDACTED projection (every other column, no `signed_by`) for every other
/// scope — see [`crate::decode::handoffs`]'s module docs' "Redaction"
/// section for the mechanism.
pub(crate) const HANDOFFS_TABLE: &str = "handoffs";

/// Name of the raw typed-`grant_replays` registration, carrying the raw
/// `signer_public_key` column [`crate::decode::grant_replays::schema`]
/// decodes.
///
/// [`GRANT_REPLAYS_TABLE`] (see below) is built from this table — mirroring
/// [`PAYMENTS_RAW_TABLE`]/[`PAYMENTS_TABLE`]'s raw-table/view split. Present
/// in the catalog only for [`QueryScope::Fleet`]; every other scope
/// deregisters it immediately after [`QueryEngine::build`] builds the
/// `grant_replays` view — see [`crate::decode::grant_replays`]'s module
/// docs' "Column selection and redaction" section.
pub(crate) const GRANT_REPLAYS_RAW_TABLE: &str = "grant_replays_raw";

/// Name of the `grant_replays` view, registered for every scope with
/// SCOPE-DEPENDENT columns.
///
/// The full row (`signer_public_key` included) for [`QueryScope::Fleet`], a
/// REDACTED projection (every other column, no `signer_public_key`) for
/// every other scope — see [`crate::decode::grant_replays`]'s module docs'
/// "Column selection and redaction" section for the mechanism.
pub(crate) const GRANT_REPLAYS_TABLE: &str = "grant_replays";

/// Name of the `personas` reference table — [`QueryScope::Fleet`] only, see
/// the module docs' "Reference data" section.
pub(crate) const PERSONAS_TABLE: &str = "personas";

/// Name of the `participations` reference table — [`QueryScope::Fleet`]
/// only, see the module docs' "Reference data" section.
pub(crate) const PARTICIPATIONS_TABLE: &str = "participations";

/// Name of the `persona_identities` reference table — [`QueryScope::Fleet`]
/// only, registered alongside [`PERSONAS_TABLE`]/[`PARTICIPATIONS_TABLE`],
/// see the module docs' "Reference data" section.
pub(crate) const PERSONA_IDENTITIES_TABLE: &str = "persona_identities";

/// Name of the `persona_wallets` reference table (#1578, Phase D) —
/// [`QueryScope::Fleet`] only, registered alongside [`PERSONAS_TABLE`]. Every
/// [`crate::decode::persona::PersonaWalletRow`] field is forensics-parity
/// (unredacted at Fleet scope) except `key_ref`; see
/// [`crate::decode::persona`]'s module docs' "Bulk-export invariant (QRY-8)"
/// section.
pub(crate) const PERSONA_WALLETS_TABLE: &str = "persona_wallets";

/// Name of the `persona_spend_policies` reference table (#1578, Phase D) —
/// [`QueryScope::Fleet`] only, registered alongside [`PERSONAS_TABLE`]. Every
/// [`crate::decode::persona::PersonaSpendPolicyRow`] field is
/// forensics-parity (no key-material field exists on this record to begin
/// with); see [`crate::decode::persona`]'s module docs' "Bulk-export
/// invariant (QRY-8)" section.
pub(crate) const PERSONA_SPEND_POLICIES_TABLE: &str = "persona_spend_policies";

/// Name of the `persona_credentials` reference table (#1578, Phase D) —
/// [`QueryScope::Fleet`] only, registered alongside [`PERSONAS_TABLE`]. Every
/// [`crate::decode::persona::PersonaCredentialRow`] field is
/// forensics-parity (unredacted at Fleet scope) except the three
/// key-material fields (`credential_id`, `p256_public_key_sec1`,
/// `signing_public_key`); see [`crate::decode::persona`]'s module docs'
/// "Bulk-export invariant (QRY-8)" section.
pub(crate) const PERSONA_CREDENTIALS_TABLE: &str = "persona_credentials";

/// Name of the `persona_usage` reference table (#1578, Phase D) —
/// [`QueryScope::Fleet`] only, registered alongside [`PERSONAS_TABLE`]. A
/// PER-PERSONA aggregate off `PersonaHost`'s maintained `UsageRollup` —
/// distinct from the PER-TURN, event-log-derived [`USAGE_TABLE`]; see
/// [`crate::decode::persona`]'s module docs' "`usage` vs. `persona_usage`"
/// section.
pub(crate) const PERSONA_USAGE_TABLE: &str = "persona_usage";

/// Name of the `dashboard` reference table — the dashboard maintained
/// projection (#1584/#1585) exposed as Fleet-only reference data, the same
/// "never registered for any other scope" posture [`PERSONAS_TABLE`]/
/// [`PARTICIPATIONS_TABLE`] use, not the "resolvable but redacted" posture
/// `attribution`/`payments`/... use — see
/// [`crate::decode::dashboard`]'s module docs for the column set and why
/// Fleet-only IS this table's admin gate (QRY-2-D, #1537).
pub(crate) const DASHBOARD_TABLE: &str = "dashboard";