-- Formal break-glass welfare access: explicit capability, named case, expiry and immutable review trail.
ALTER TABLE welfare_exceptional_access
 ADD COLUMN subject_case_id BIGINT UNSIGNED NULL AFTER scope_key,
 ADD COLUMN review_due_at DATETIME NULL AFTER expires_at,
 ADD COLUMN notified_at DATETIME NULL AFTER last_used_at,
 ADD KEY idx_welfare_exception_subject(scope_key,subject_case_id,user_id,expires_at);
CREATE TABLE IF NOT EXISTS welfare_exceptional_access_events (
 id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
 access_id BIGINT UNSIGNED NOT NULL,
 scope_key VARCHAR(80) NOT NULL,
 subject_case_id BIGINT UNSIGNED NOT NULL,
 actor_id BIGINT UNSIGNED NOT NULL,
 event_key ENUM('granted','used','revoked','expired_reviewed') NOT NULL,
 occurred_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 safe_reason_hash CHAR(64) NOT NULL,
 KEY idx_welfare_exception_event_review(scope_key,occurred_at),
 FOREIGN KEY(access_id) REFERENCES welfare_exceptional_access(id),
 FOREIGN KEY(subject_case_id) REFERENCES welfare_cases(id),
 FOREIGN KEY(actor_id) REFERENCES users(id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;