-- Phase 7: a fence token on the per-instance lease (es_saga_leases).
--
-- 002's bet was "OCC on stream_version is the fence; no token needed." That
-- holds for the LOG (a preempted holder's commit conflicts on the version) but
-- not for EFFECTS that run before the commit — most sharply the async publisher
-- path (review H-2). The fence makes a takeover explicit and lets the lease TTL
-- be SHORT without a slow-but-alive holder being raced into a duplicate effect:
-- stealing an expired lease bumps the fence, the holder heartbeats WHERE its
-- fence still matches (so it learns it was stolen from and stops), and a holder
-- that reuses the same worker_id after a restart can't masquerade as its own
-- stale lease.
--
-- Mirrors mire's es_subscriptions.fence_token (the projection-runner precedent).
--
-- Append-only migration (008); idempotent. fence starts at 0 for any
-- pre-existing row; acquire() sets it to 1 on a fresh lease and bumps on steal.
ALTER TABLE es_saga_leases
    ADD COLUMN IF NOT EXISTS fence BIGINT NOT NULL DEFAULT 0;
