27 lines
1.6 KiB
SQL
27 lines
1.6 KiB
SQL
-- +goose Up
|
|
|
|
-- The carrier of "the bank moved" — the fact the correction door creates and nothing recorded
|
|
-- until now (the receipt died with the caller; P10, D39.165 §3 + errata 28.08-к). The door stamps
|
|
-- it from its OWN receipt (an apply that changed files, or answered already_applied on a retry) —
|
|
-- never from the engine's status projection, which is BLIND to a correction until the next
|
|
-- translate folds the bank into memory (the adversarial pass's K1). The fact is retired
|
|
-- EXPLICITLY: a run that carried --resnapshot and finished `ready` clears it in reconcile.finish —
|
|
-- no timestamp comparison, no clock pairing, and a failed or interrupted run leaves the fact
|
|
-- standing, so the next admission still carries the flags instead of dying on the engine's
|
|
-- snapshot guard forever.
|
|
alter table books add column bank_moved_at timestamptz;
|
|
|
|
-- The run's own consents, decided ONCE at admission (Start/Resume, under the book lock) and read
|
|
-- by every spawn of every attempt — the discipline verify_bank rides: argv must be STABLE across
|
|
-- respawns, a flag must not appear mid-run because a sweep re-derived it from fresher state.
|
|
-- accept_rebill_micro is the FUNDED cap: the run's own hold — consent to re-pay no more than this
|
|
-- run may spend at all — never a projection (which does not exist at admission time, K1) and never
|
|
-- the bare blanket form.
|
|
alter table runs add column resnapshot boolean not null default false;
|
|
alter table runs add column accept_rebill_micro bigint not null default 0;
|
|
|
|
-- +goose Down
|
|
|
|
alter table runs drop column accept_rebill_micro;
|
|
alter table runs drop column resnapshot;
|
|
alter table books drop column bank_moved_at;
|