ALTER TABLE operation_task
    ADD COLUMN hold_reason text,
    ADD COLUMN verification_result text CHECK (verification_result IN ('not_executed', 'succeeded', 'failed')),
    ADD COLUMN verified_at timestamptz,
    ADD COLUMN verified_by text,
    ADD CONSTRAINT operation_task_verification_consistent CHECK (
        (verification_result IS NULL AND verified_at IS NULL AND verified_by IS NULL)
        OR
        (verification_result IS NOT NULL AND verified_at IS NOT NULL AND verified_by = 'local-user')
    );

UPDATE operation_task
SET hold_reason = CASE state
    WHEN 'policy_hold' THEN 'legacy_policy_hold'
    WHEN 'needs_confirmation' THEN 'task_result_uncertain'
END
WHERE state IN ('policy_hold', 'needs_confirmation');

ALTER TABLE execution_attempt
    DROP CONSTRAINT execution_attempt_task_id_key;

CREATE INDEX execution_attempt_task_id_idx
    ON execution_attempt (task_id, started_at, id);
CREATE INDEX operation_task_filter_idx
    ON operation_task (state, account_id, created_at DESC);
CREATE INDEX audit_event_filters_idx
    ON audit_event (created_at DESC, account_id, task_id, event_type);