ALTER TABLE audit_events
  ADD COLUMN request_id text NOT NULL DEFAULT '';
CREATE INDEX audit_events_request_idx ON audit_events(request_id, created_at DESC) WHERE request_id <> '';

CREATE TABLE runtime_log_events (
  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  level text NOT NULL CHECK (level IN ('debug','info','warn','error')),
  message text NOT NULL CHECK (length(message) BETWEEN 1 AND 256),
  request_id text NOT NULL DEFAULT '',
  method text NOT NULL DEFAULT '',
  path text NOT NULL DEFAULT '',
  status_code integer NOT NULL DEFAULT 0 CHECK (status_code BETWEEN 0 AND 599),
  duration_ms bigint NOT NULL DEFAULT 0 CHECK (duration_ms >= 0),
  detail jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(detail)='object'),
  created_at timestamptz NOT NULL DEFAULT now()
);
CREATE INDEX runtime_log_events_time_idx ON runtime_log_events(created_at DESC);
CREATE INDEX runtime_log_events_request_idx ON runtime_log_events(request_id,created_at DESC) WHERE request_id <> '';

ALTER TABLE operation_jobs
  ADD COLUMN schema_version integer NOT NULL DEFAULT 1,
  ADD COLUMN stage text NOT NULL DEFAULT 'queued',
  ADD COLUMN priority integer NOT NULL DEFAULT 0 CHECK (priority BETWEEN -100 AND 100),
  ADD COLUMN progress_skipped bigint NOT NULL DEFAULT 0 CHECK (progress_skipped >= 0),
  ADD COLUMN retryable boolean NOT NULL DEFAULT true,
  ADD COLUMN next_retry_at timestamptz,
  ADD COLUMN claimed_by text NOT NULL DEFAULT '',
  ADD COLUMN payload jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(payload)='object');

CREATE TABLE backup_policies (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  scope text NOT NULL CHECK (scope IN ('s','e','auth','all')),
  enabled boolean NOT NULL DEFAULT true,
  interval_hours integer NOT NULL DEFAULT 24 CHECK (interval_hours BETWEEN 1 AND 720),
  retention_count integer NOT NULL DEFAULT 14 CHECK (retention_count BETWEEN 1 AND 365),
  updated_by uuid REFERENCES users(id) ON DELETE SET NULL,
  created_at timestamptz NOT NULL DEFAULT now(),
  updated_at timestamptz NOT NULL DEFAULT now(),
  UNIQUE(scope)
);

CREATE TABLE backup_artifacts (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  scope text NOT NULL CHECK (scope IN ('s','e','auth','all')),
  state text NOT NULL DEFAULT 'queued' CHECK (state IN ('queued','running','succeeded','failed','expired','deleted')),
  storage_key text NOT NULL,
  size_bytes bigint NOT NULL DEFAULT 0 CHECK (size_bytes >= 0),
  sha256 text NOT NULL DEFAULT '' CHECK (sha256 = '' OR sha256 ~ '^[0-9a-f]{64}$'),
  job_id uuid REFERENCES operation_jobs(id) ON DELETE SET NULL,
  error_code text NOT NULL DEFAULT '',
  error_summary text NOT NULL DEFAULT '',
  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
  created_at timestamptz NOT NULL DEFAULT now(),
  completed_at timestamptz,
  deleted_at timestamptz
);
CREATE INDEX backup_artifacts_scope_idx ON backup_artifacts(scope,created_at DESC);

CREATE TABLE system_runtime_state (
  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
  maintenance boolean NOT NULL DEFAULT false,
  maintenance_reason text NOT NULL DEFAULT '',
  maintenance_job_id uuid REFERENCES operation_jobs(id) ON DELETE SET NULL,
  updated_by uuid REFERENCES users(id) ON DELETE SET NULL,
  updated_at timestamptz NOT NULL DEFAULT now()
);
INSERT INTO system_runtime_state(singleton) VALUES (true) ON CONFLICT DO NOTHING;

CREATE TABLE update_artifacts (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  product text NOT NULL CHECK (product IN ('s','e','auth')),
  platform text NOT NULL,
  version text NOT NULL,
  channel text NOT NULL CHECK (channel IN ('stable','preview')),
  download_url text NOT NULL DEFAULT '',
  sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),
  signature text NOT NULL DEFAULT '',
  min_s_version text NOT NULL DEFAULT '',
  min_e_version text NOT NULL DEFAULT '',
  state text NOT NULL DEFAULT 'authorized' CHECK (state IN ('authorized','downloaded','verified','staged','applied','rolled_back','failed')),
  storage_key text NOT NULL DEFAULT '',
  job_id uuid REFERENCES operation_jobs(id) ON DELETE SET NULL,
  error_code text NOT NULL DEFAULT '',
  error_summary text NOT NULL DEFAULT '',
  created_by uuid REFERENCES users(id) ON DELETE SET NULL,
  created_at timestamptz NOT NULL DEFAULT now(),
  updated_at timestamptz NOT NULL DEFAULT now(),
  UNIQUE(product,platform,version,channel)
);
CREATE INDEX update_artifacts_state_idx ON update_artifacts(product,state,updated_at DESC);