-- Internal coordination only: raw bytes remain in the document storage service.
CREATE TABLE opt_document_upload_attempts (
  tenant_id text NOT NULL CHECK (length(tenant_id) BETWEEN 1 AND 256),
  project_id text NOT NULL CHECK (length(project_id) BETWEEN 1 AND 256),
  actor_id text NOT NULL CHECK (length(actor_id) BETWEEN 1 AND 256),
  attempt_id text NOT NULL CHECK (length(attempt_id) BETWEEN 1 AND 256),
  source_sha256 text NOT NULL CHECK (source_sha256 ~ '^[0-9a-f]{64}$'),
  source_size_bytes bigint NOT NULL CHECK (source_size_bytes > 0 AND source_size_bytes <= 9007199254740991),
  request_fingerprint text NOT NULL CHECK (request_fingerprint ~ '^[0-9a-f]{64}$'),
  state text NOT NULL CHECK (state IN ('prepared', 'dispatch_started')),
  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
  PRIMARY KEY (tenant_id, attempt_id)
);
ALTER TABLE opt_document_upload_attempts ENABLE ROW LEVEL SECURITY;
ALTER TABLE opt_document_upload_attempts FORCE ROW LEVEL SECURITY;
CREATE POLICY opt_document_upload_attempt_scope ON opt_document_upload_attempts
  USING (tenant_id = current_setting('app.opt_tenant_id', true)
    AND project_id = current_setting('app.opt_project_id', true)
    AND actor_id = current_setting('app.opt_actor_id', true))
  WITH CHECK (tenant_id = current_setting('app.opt_tenant_id', true)
    AND project_id = current_setting('app.opt_project_id', true)
    AND actor_id = current_setting('app.opt_actor_id', true));