AI Implementation feature(918): Admin Area System: Database Backup/Restore and Danger Zone 1.01 (#63)

docs/database/users.md

@@ -3,7 +3,7 @@ type: database
 title: User Table
 description: The `user` table — accounts, roles, and statuses.
 tags: [database, user, auth]
-timestamp: 2026-07-21T17:37:18Z
+timestamp: 2026-07-23T13:27:25Z
 ---
 
 # Schema
@@ -31,6 +31,16 @@ timestamp: 2026-07-21T17:37:18Z
   demote or delete the last admin are rejected by
   `UsersService.enforceLastAdminInvariant` (used by
   `AdminService.updateUserRole` and `AdminService.deleteUser`).
+- A deployment-wide database safety net backs the invariant up at the
+  SQLite level via two triggers created by the
+  `AddUserLastAdminTriggers1700000000800` migration:
+  `trg_user_last_admin_update` (fires on `UPDATE OF role` when the old
+  row was admin, the new role is not, and no other admin row exists)
+  and `trg_user_last_admin_delete` (fires on `DELETE` of an admin row
+  when no other admin row exists). Both abort the offending statement
+  with `RAISE(ABORT, 'LAST_ADMIN')`. They are recreated by the restore
+  rebuild after the candidate database is rebuilt — see
+  [Admin System Endpoints — POST /restore/commit](/api/admin-system.md).
 
 # First-admin bootstrap