-- Immutable commit evidence shared by ingestion and REST/MCP fact rebuild.
-- No raw flow payload, IP addresses, credentials or notification contents belong here.
CREATE TABLE IF NOT EXISTS flow_write_receipts (
  batch_id uuid PRIMARY KEY,
  kind text NOT NULL CHECK (kind IN ('ingest', 'facts', 'rebuild')),
  source_proof text NOT NULL CHECK (source_proof ~ '^[a-f0-9]{64}$'),
  result jsonb NOT NULL CHECK (jsonb_typeof(result) = 'object' AND octet_length(result::text) <= 65536),
  committed_at timestamptz NOT NULL DEFAULT now()
);
-- Receipts are intentionally not pruned: an owned unknown batch may still need them.