-- environment_events — audit trail for every lifecycle transition.
-- See docs/LAB_ARCHITECTURE.md §3/§8 and docs/PHASE1_PLATFORM_FOUNDATION.md §2/§9.
-- Never log secrets or routing tokens in plaintext here (see lifecycle.js emitEvent()).

CREATE TABLE IF NOT EXISTS environment_events (
  id              BIGSERIAL PRIMARY KEY,
  environment_id  UUID NOT NULL REFERENCES environments(environment_id),
  event_type      TEXT NOT NULL,   -- provision_requested | host_selected | network_created |
                                    -- firewall_configured | container_created | ready |
                                    -- reset | destroyed | error | reaped_idle | suspend | resume
  actor           TEXT NOT NULL,   -- 'system' | 'instructor:<id>' | 'student:<id>' | 'reaper'
  detail          JSONB,
  created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX IF NOT EXISTS idx_env_events_environment ON environment_events(environment_id);
CREATE INDEX IF NOT EXISTS idx_env_events_type ON environment_events(event_type);