-- The move of the controller's secrets into the vault (novox/hq ADR 0349 clause 7; design 57's V3, issue 676).
--
-- The controller cannot open a value it holds, so each machine's node-engine hands in what was sealed to it, and a
-- machine asleep when the move starts is moved when it is next heard from. These two tables are what lets the
-- controller tell, then and later, what has moved: that the move was started, by whom, and whether the record of
-- asks was copied; and each row the vault took, under the vault's name for it, with the machine whose engine handed
-- it in, the vault's generation, and a digest of the sealed text the row held then — so a row the controller
-- changed after it moved is said, never moved over the vault's value. No value and no sealed value is kept here.
create table secret_move (
    one           boolean     primary key default true check (one),
    started_at    timestamptz not null default now(),
    started_by    text        not null,
    asks_moved_at timestamptz
);

create table secret_moved (
    secret        text        primary key,
    node          uuid        not null references node(id) on delete cascade,
    generation    integer     not null check (generation > 0),
    sealed_digest text        not null,
    moved_at      timestamptz not null default now()
);