CREATE INDEX IF NOT EXISTS mcp_audit_handshake_cooldown
  ON mcp_audit(connection_id, created_at DESC)
  WHERE action = 'connection.handshake.start';
CREATE INDEX IF NOT EXISTS mcp_credentials_readiness_expired
  ON mcp_credentials(connection_id, expires_at)
  WHERE client_id = 'mcp-readiness-probe';
CREATE INDEX IF NOT EXISTS mcp_grants_credential
  ON mcp_grants(connection_id, (payload->>'credentialId'));