Administrative corrections
Every operator action, what it requires, and what it records.
Every correction is additive. There is no command that edits a credit, deletes an event or sets a balance. A mistake is corrected by appending an event that names what it supersedes, who did it and why — and the original stays visible in the audit log forever.
The command surface
Generated from the command classes themselves, so this table cannot drift from the code. Owner-level approval is not defined anywhere in the agreement; rather than invent a threshold, every row says so.
Scroll the table sideways to see every column.
| Command | Effect | Permission | Appends | Reason | Owner approval |
|---|---|---|---|---|---|
| AcceptAffiliate | Enrols a partner under a named rule set version. | admin.affiliate.write | AffiliateEnrolled | Required | Not defined |
| AdjustCredits | Signed manual adjustment, always attributed and explained. | admin.credit.write | CreditAdjusted | Required | Not defined — a manual credit adjustment has no stated approval threshold |
| CommitMonthlyReview | Commits a previewed review proposal to the ledger. | admin.credit.write | CreditIssued CreditReversed MonthlyReviewCompleted | Required | Not defined |
| CorrectAttribution | Moves a customer to a different partner, additively. | admin.attribution.write | AttributionCorrected | Required | Not defined — moving a customer between partners has no stated approval path |
| FlagCustomerIneligible | Marks self, household, duplicate or fraudulent activity. | admin.attribution.write | CustomerFlaggedIneligible | Required | Not defined |
| IssueLaunchGrant | Issues launch credits due at the start of the current launch month. | admin.credit.write | CreditIssued | Required | Not defined — Section 1 requires an authorized officer or manager to approve credits; the record of that approval is not modelled |
| PublishRuleSetVersion | Records which program terms govern from a date. | admin.ruleset.write | RuleSetActivated | Required | Not defined — publishing new program terms is a signed-agreement change |
| ReinstateAffiliate | Closes an open suspension window. | admin.affiliate.write | AffiliateReinstated | Required | Not defined |
| ReverseCredit | Claws back issued credits without deleting the issuance. | admin.credit.write | CreditReversed | Required | Not defined |
| SetLeaderboardPreference | Honours a partner's public leaderboard opt-out. | partner.profile.write | AffiliateLeaderboardPreferenceSet | Required | Not defined |
| SuspendAffiliate | Pauses credit issuance from the effective date. | admin.affiliate.write | AffiliateSuspended | Required | Not defined |
| VoidAttribution | Removes ownership entirely (fraud, duplicate, correction). | admin.attribution.write | AttributionVoided | Required | Not defined |
Controls
Prototype only. Every control is inert and states the permission it needs, the events it would append, whether a reason is mandatory, and whether owner approval is defined.
Enrols a partner under a named rule set version. Prototype only — this control is inert.
Signed manual adjustment, always attributed and explained. Prototype only — this control is inert.
Commits a previewed review proposal to the ledger. Prototype only — this control is inert.
Moves a customer to a different partner, additively. Prototype only — this control is inert.
Marks self, household, duplicate or fraudulent activity. Prototype only — this control is inert.
Issues launch credits due at the start of the current launch month. Prototype only — this control is inert.
Records which program terms govern from a date. Prototype only — this control is inert.
Closes an open suspension window. Prototype only — this control is inert.
Claws back issued credits without deleting the issuance. Prototype only — this control is inert.
Honours a partner's public leaderboard opt-out. Prototype only — this control is inert.
Pauses credit issuance from the effective date. Prototype only — this control is inert.
Removes ownership entirely (fraud, duplicate, correction). Prototype only — this control is inert.
Rules an operator cannot break
- Named actor required
- A command attributed to
system, or to nobody, is refused at construction. - Reason required
- An empty reason is refused. An unexplained correction cannot reach the ledger.
- No re-running a review
- A committed review is refused a second time for that partner. Issue a correction instead.
- No early review
- A review month is refused until its last day has passed, and it reads only facts dated on or before the commit date.
- No backdated launch credits
- Launch credits are dated the day they are issued. A launch month that closed unissued is refused while OQ-31 is unresolved.
- No zero adjustments
- An adjustment of zero credits is not a correction and is refused.
- No unknown rule set
- Activating an unpublished rule set version is refused.
- No identity by default
- Resolving a customer handle to an internal id needs
admin.customer.identify. Operator views redact without it.