-- +goose Up

-- The carrier of "the bank moved" — the fact the correction door creates and nothing recorded
-- until now (the receipt died with the caller; P10, D39.165 §3 + errata 28.08-к). The door stamps
-- it from its OWN receipt (an apply that changed files, or answered already_applied on a retry) —
-- never from the engine's status projection, which is BLIND to a correction until the next
-- translate folds the bank into memory (the adversarial pass's K1). The fact is retired
-- EXPLICITLY: a run that carried --resnapshot and finished `ready` clears it in reconcile.finish —
-- no timestamp comparison, no clock pairing, and a failed or interrupted run leaves the fact
-- standing, so the next admission still carries the flags instead of dying on the engine's
-- snapshot guard forever.
alter table books add column bank_moved_at timestamptz;

-- The run's own consents, decided ONCE at admission (Start/Resume, under the book lock) and read
-- by every spawn of every attempt — the discipline verify_bank rides: argv must be STABLE across
-- respawns, a flag must not appear mid-run because a sweep re-derived it from fresher state.
-- accept_rebill_micro is the FUNDED cap: the run's own hold — consent to re-pay no more than this
-- run may spend at all — never a projection (which does not exist at admission time, K1) and never
-- the bare blanket form.
alter table runs add column resnapshot boolean not null default false;
alter table runs add column accept_rebill_micro bigint not null default 0;

-- +goose Down

alter table runs drop column accept_rebill_micro;
alter table runs drop column resnapshot;
alter table books drop column bank_moved_at;