-- Persist the per-mission runtime's bearer token.
--
-- The pairing code in `runtime_pairing_code` is SINGLE USE: once the gateway is
-- paired it reports "already paired" and mints no new code. The token that pair
-- returns was cached in memory only (`ZeroClawDriveExecutor::token`), so any
-- restart of the server discarded it — and the next turn re-paired with a code
-- that had already been spent and got 403 Forbidden, permanently, for that
-- mission.
--
-- Mission 01a00538 ("ClawHDF5 REsearch and Refactor") died exactly that way: 19
-- minutes and 93,762 tokens into its research phase, killed by a server restart
-- it should have survived, and its coding phase was then correctly skipped as
-- unreachable. The durable-run machinery exists so work survives a restart;
-- pairing was the one thread that did not.
--
-- Nullable: a mission that has not paired yet has no token, and the pre-C3
-- missions never will.
ALTER TABLE missions
    ADD COLUMN IF NOT EXISTS runtime_token TEXT;

COMMENT ON COLUMN missions.runtime_token IS
    'Bearer token for this mission runtime gateway, persisted so a server restart reuses it instead of re-pairing with a spent single-use code.';