BEGIN;
CREATE TABLE public.server_probe_terminal_proofs (
 operation_id uuid PRIMARY KEY REFERENCES public.mcp_operations(id),
 receipt_id uuid NOT NULL UNIQUE,
 source jsonb NOT NULL CHECK(jsonb_typeof(source)='object' AND octet_length(source::text) BETWEEN 1 AND 8192),
 source_proof text NOT NULL CHECK(source_proof ~ '^[a-f0-9]{64}$'),
 idempotency_digest text NOT NULL CHECK(idempotency_digest ~ '^[a-f0-9]{64}$'),
 capture_proof text NOT NULL CHECK(capture_proof ~ '^[a-f0-9]{64}$'),
 CHECK((source->>'version') IS NOT DISTINCT FROM '1'
   AND (source->>'executionId') IS NOT DISTINCT FROM operation_id::text
   AND (source->>'receiptId') IS NOT DISTINCT FROM receipt_id::text)
);
CREATE FUNCTION public.server_probe_terminal_proof_guard() RETURNS trigger
LANGUAGE plpgsql SET search_path=pg_catalog,public AS $$
BEGIN
 IF TG_OP='INSERT' THEN
  IF EXISTS(
   SELECT 1 FROM public.mcp_operations o
   JOIN public.mcp_plans p ON p.id=o.plan_id AND p.connection_id=o.connection_id
   JOIN public.mcp_connections c ON c.id=o.connection_id
   JOIN public.server_probe_storage_admissions a ON a.execution_id=o.id AND a.identity_kind='mcp' AND a.owner_id=c.owner_id
   JOIN public.server_probe_executions j ON j.receipt_id=a.receipt_id
   JOIN public.server_probe_execution_payloads b ON b.receipt_id=a.receipt_id AND b.receipt_proof=j.receipt_proof
   WHERE o.id=NEW.operation_id AND a.receipt_id=NEW.receipt_id AND a.purged_at IS NULL AND a.cancelled_at IS NULL
    AND a.claim_token IS NULL AND a.claim_attempted_at IS NOT NULL
    AND o.state='applied' AND o.verification='inconclusive' AND o.error_code IS NULL
    AND p.state='completed' AND p.operation_id='servers.probes.run' AND p.operation_version=1
    AND j.state='completed' AND j.execution_id=o.id AND j.mcp_connection_id=c.id AND j.actor_id=c.owner_id
    AND NEW.source->>'connectionId'=c.id::text AND NEW.source->>'planId'=p.id::text
    AND NEW.source->>'ownerId'=a.owner_id AND NEW.source->>'bindingProof'=a.binding_proof
    AND NEW.source->>'receiptProof'=b.receipt_proof
    AND NEW.source->>'ciphertextSha256'=encode(sha256(convert_to(b.receipt_ciphertext,'UTF8')),'hex')
  ) THEN RETURN NEW; END IF;
 ELSIF TG_OP='DELETE' THEN
  IF EXISTS(
   SELECT 1 FROM public.server_probe_retirement_claims r
   JOIN public.mcp_operation_replay_tombstones t ON t.operation_id=r.operation_id AND t.plan_id=r.plan_id AND t.connection_id=r.connection_id
   WHERE r.operation_id=OLD.operation_id AND r.receipt_id=OLD.receipt_id AND r.source_proof=OLD.source_proof
    AND r.claim_xid<>pg_current_xact_id() AND r.claim_token::text=current_setting('mm.probe_retirement_claim',true)
    AND t.action_id='servers.probes.run' AND NOT t.target_global AND t.idempotency_digest=OLD.idempotency_digest
    AND OLD.source->'serverIds'=to_jsonb(t.target_server_ids)
  ) THEN RETURN OLD; END IF;
 END IF;
 RAISE EXCEPTION 'diagnostic terminal proof must match its original source or exact retirement claim';
END $$;
CREATE TRIGGER server_probe_terminal_proof_guard BEFORE INSERT OR UPDATE OR DELETE
 ON public.server_probe_terminal_proofs FOR EACH ROW EXECUTE FUNCTION public.server_probe_terminal_proof_guard();
CREATE TRIGGER server_probe_terminal_proof_no_truncate BEFORE TRUNCATE
 ON public.server_probe_terminal_proofs FOR EACH STATEMENT EXECUTE FUNCTION public.server_probe_terminal_proof_guard();

CREATE OR REPLACE FUNCTION public.server_probe_retirement_claim_guard() RETURNS trigger
LANGUAGE plpgsql SET search_path=pg_catalog,public SET TimeZone='UTC' AS $$
BEGIN
 IF TG_OP='INSERT' AND NEW.claim_xid=pg_current_xact_id() AND EXISTS(
  SELECT 1 FROM public.mcp_operations o
  JOIN public.mcp_plans p ON p.id=o.plan_id AND p.connection_id=o.connection_id
  JOIN public.mcp_connections c ON c.id=o.connection_id
  WHERE o.id=NEW.operation_id AND p.id=NEW.plan_id AND c.id=NEW.connection_id
   AND o.state='applied' AND o.verification='inconclusive' AND o.error_code IS NULL
   AND isfinite(o.finished_at) AND o.finished_at<transaction_timestamp()-interval '180 days'
   AND p.operation_id='servers.probes.run' AND p.operation_version=1 AND p.state='completed'
   AND (EXISTS(SELECT 1 FROM public.server_probe_storage_admissions a
     WHERE a.receipt_id=NEW.receipt_id AND a.execution_id=o.id AND a.identity_kind='mcp' AND a.owner_id=c.owner_id
      AND a.claim_token IS NULL AND a.claim_attempted_at IS NOT NULL AND a.cancelled_at IS NULL AND a.purged_at IS NULL)
    OR(EXISTS(SELECT 1 FROM public.server_probe_terminal_proofs f
       WHERE f.operation_id=o.id AND f.receipt_id=NEW.receipt_id AND f.source_proof=NEW.source_proof
        AND f.source->>'ownerId'=c.owner_id AND f.source->>'connectionId'=c.id::text AND f.source->>'planId'=p.id::text)
       AND NOT EXISTS(SELECT 1 FROM public.server_probe_storage_admissions a
         WHERE a.receipt_id=NEW.receipt_id OR(a.identity_kind='mcp' AND a.execution_id=o.id))))
 ) THEN RETURN NEW; END IF;
 RAISE EXCEPTION 'diagnostic retirement claim cannot be replaced or reopened';
END $$;
INSERT INTO public.schema_migrations(id) VALUES ('0053_server_probe_terminal_proofs') ON CONFLICT(id) DO NOTHING;
COMMIT;