challenge the following implement-time decisions (implementation is already in the working tree; review the diff of insuniverse-server against 76e25be7 and the plan .claude/PRPs/plans/admin-rbac-m5.plan.md): (1) access-identity.ts non-throwing identity resolver with ordered kinds admin/member/view-token/external-basic/invalid/none; (2) global access-control guard only prepares a judgment and never throws, with the enforcement path left in observe mode; (3) the scope monitor path uses a dedicated watch DB pool (connectionLimit WATCH_POOL_LIMIT, no waiting, queue 0) with a 300 ms time cap and max 2 in-flight, not the shared DrizzleService; (4) super-admin query body extracted to super-admin.query.ts and SuperAdminService delegating; (5) route-permission-map.ts generated by build-catalog.mjs with a superOnly split into -super codes; (6) first-version seed re-run refusal via the __seeded__ marker; (7) the three auth guards use getAllAndOverride and roles.guard respects only the handler-level isPublic marker. Flag any security or correctness defect in these, especially privilege escalation, fail-open paths and marker handling.