-- Reconciler ownership claim: vault destruction runs only after an intent is
-- moved to abandoning under the credential lock. Create/rotate materialize
-- refuses non-vault_written intents, so a concurrent commit cannot land a
-- durable version that points at material the reconciler is about to destroy.

ALTER TABLE secret_write_intents
    DROP CONSTRAINT secret_write_intents_status_check;

ALTER TABLE secret_write_intents
    ADD CONSTRAINT secret_write_intents_status_check CHECK (
        status IN (
            'prepared',
            'vault_written',
            'durable_committed',
            'abandoning',
            'abandoned'
        )
    );

ALTER TABLE secret_write_intents
    DROP CONSTRAINT secret_write_intents_written_has_version;

ALTER TABLE secret_write_intents
    ADD CONSTRAINT secret_write_intents_written_has_version CHECK (
        (status = 'prepared' AND vault_kv_version IS NULL)
        OR (status IN ('vault_written', 'durable_committed', 'abandoning')
            AND vault_kv_version IS NOT NULL)
        OR status = 'abandoned'
    );