-- +goose Up

-- Lets an owner restart a module's process or flip it into maintenance mode
-- from core's own dashboard — see internal/registry's Restart/SetMaintenance.
-- Unlike the heartbeat token (module -> core, stored as a one-way hash;
-- core never needs the plaintext back), this direction is core -> module,
-- so core must be able to present the plaintext again on every call — it is
-- stored as-is, same accepted tradeoff as internal/settings' API keys in
-- the production repo. Its blast radius is deliberately narrow: knowing it
-- only lets you restart or maintenance-toggle this one module, nothing
-- about its data.
ALTER TABLE modules ADD COLUMN control_token TEXT;

-- A module now has a real self-reported quiescent state distinct from
-- "unhealthy" (which reads as "something's wrong"), so an owner-triggered
-- maintenance window doesn't look like an outage on the dashboard.
ALTER TABLE modules DROP CONSTRAINT modules_status_check;
ALTER TABLE modules ADD CONSTRAINT modules_status_check
  CHECK (status IN ('unknown', 'healthy', 'unhealthy', 'maintenance'));