-- Ported from the SQLite migration of the same number. BIGINT because
-- PostgreSQL's INTEGER is 32 bits and these are milliseconds since the epoch.

-- A lease on being the control plane that places work.
--
-- Two control planes against one store both reconcile: both see a model
-- wanting two replicas and none running, and both place. The result is twice
-- the replicas, each holding GPUs the other's inventory believes are free —
-- the same failure a control plane restart used to produce before adoption,
-- and harder to see because nothing crashed.
--
-- A lease rather than a lock held by the connection. PostgreSQL has advisory
-- locks and SQLite has nothing like them, and this store keeps one set of
-- queries for both; a row with an expiry works everywhere and survives the
-- leader being killed rather than asked to stop.
--
-- One row, enforced by the primary key: there is one thing to be leader of.
CREATE TABLE leadership (
  role       TEXT PRIMARY KEY,
  -- Who holds it. An opaque id per process, so a process cannot be fooled by
  -- its own stale lease after a restart on the same host.
  owner      TEXT NOT NULL,
  -- When the lease lapses. The holder renews well before this; anyone else
  -- may take it once the clock has passed, which is what makes a leader that
  -- was powered off recoverable without anyone being paged.
  expires_at BIGINT NOT NULL,
  -- For an operator asking who has been in charge and since when.
  acquired_at BIGINT NOT NULL
);