-- Successful arrangement history belongs to an employee/group, not a task.
-- Source task/execution identifiers deliberately have NO task foreign key:
-- force deletion must not erase the business record or its receipt snapshot.
CREATE TABLE arrangement_ledger_owners (
  organization_id uuid NOT NULL REFERENCES organizations(id),
  owner_user_id uuid NOT NULL,
  backfilled_at timestamptz,
  PRIMARY KEY (organization_id, owner_user_id),
  FOREIGN KEY (organization_id, owner_user_id) REFERENCES users(organization_id, id)
);

CREATE TABLE arrangement_ledger_events (
  id bigserial PRIMARY KEY,
  organization_id uuid NOT NULL REFERENCES organizations(id),
  owner_user_id uuid NOT NULL,
  group_key text NOT NULL,
  action text NOT NULL CHECK (action IN (
    'arrangement_guide', 'arrangement_vehicle', 'arrangement_hotel',
    'arrangement_transport', 'arrangement_other'
  )),
  source_task_id text NOT NULL,
  execution_id text NOT NULL,
  effective_at timestamptz NOT NULL,
  recorded_at timestamptz NOT NULL,
  source_task_deleted_at timestamptz,
  detail_ciphertext text NOT NULL,
  UNIQUE (organization_id, owner_user_id, execution_id),
  FOREIGN KEY (organization_id, owner_user_id) REFERENCES users(organization_id, id)
);
CREATE INDEX arrangement_ledger_group_idx ON arrangement_ledger_events
  (organization_id, owner_user_id, group_key, effective_at, id);
CREATE INDEX arrangement_ledger_source_task_idx ON arrangement_ledger_events
  (organization_id, owner_user_id, source_task_id);

CREATE TRIGGER arrangement_ledger_owner_not_admin
BEFORE INSERT OR UPDATE OF organization_id, owner_user_id ON arrangement_ledger_owners
FOR EACH ROW EXECUTE FUNCTION reject_admin_task_principal('owner_user_id', 'arrangement_ledger_owner_not_admin');
CREATE TRIGGER arrangement_ledger_event_owner_not_admin
BEFORE INSERT OR UPDATE OF organization_id, owner_user_id ON arrangement_ledger_events
FOR EACH ROW EXECUTE FUNCTION reject_admin_task_principal('owner_user_id', 'arrangement_ledger_event_owner_not_admin');