Connectivity, schema, indexes, storage posture, migration ledger, and required-object gaps become visible before action.
Governed maintenance
Database change follows a visible safety sequence.
Operators inspect first, preview the effect, preserve a recoverable state, then apply bounded change and verify the result.
Dry-run output, checksums, statement counts, destructive-SQL detection, and pre-maintenance backup establish the safety boundary.
Advisory locking, operator approval, migration or pruning, and bounded batches prevent uncontrolled concurrent change.
Vacuum/analyze, runtime checks, post-operation evidence, and recovery context close the loop.
Living ERD
The data model stays understandable as the platform evolves.
Identity, federation, infrastructure state, sessions, evidence, classroom operations, topology, and reconciliation all depend on a healthy schema. The ERD is treated as a living operational surface instead of a stale design-time drawing.
- Current tables and relationships remain visible.
- Schema evolution is reconciled with the migration ledger.
- Operational domains remain traceable to the data they depend on.
- Database credentials and URLs stay out of maintenance output.
Control surfaces
Maintenance work is separated into explicit operating modes.
The control plane favors previewable, bounded actions over broad database access.
Living ERD
Current tables, relationships, domains, and schema evolution remain visible as the platform changes.
Runtime audit
Connectivity, required tables, indexes, ledger state, storage, and schema gaps are checked before work begins.
Migration console
Dry-run preview, checksums, statement counts, destructive-SQL detection, advisory locking, approval, and results.
Retention & pruning
Policy-based age retention, dry-run counts, bounded batches, optional size caps, and oldest-first deletion.
Backup & recovery
Pre-maintenance backups, restore posture, survivability, and rollback context stay attached to the operation.
Maintenance
Vacuum/analyze and post-operation verification close the maintenance cycle with secret-safe output.
Database safety
The database is part of the control plane, not an afterthought.
The safe path blocks destructive SQL, serializes migration work, previews pruning, keeps secret material out of logs, and puts backup ahead of change unless a separately justified break-glass path is chosen.