ALTER TABLE bell_alerts
    ADD COLUMN acknowledged_by uuid REFERENCES bell_users(id),
    ADD COLUMN acknowledged_at timestamptz,
    ADD COLUMN closed_by uuid REFERENCES bell_users(id),
    ADD COLUMN closed_at timestamptz,
    ADD COLUMN close_outcome text CHECK (close_outcome IN ('danger_confirmed','false_positive','site_normal','unable_to_confirm')),
    ADD COLUMN close_note text;
CREATE TABLE bell_alert_lifecycle_facts (
    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    alert_id uuid NOT NULL REFERENCES bell_alerts(id),
    transition text NOT NULL CHECK (transition IN ('acknowledged','closed')),
    actor_user_id uuid NOT NULL REFERENCES bell_users(id),
    occurred_at timestamptz NOT NULL DEFAULT now(),
    details jsonb NOT NULL DEFAULT '{}'::jsonb,
    UNIQUE(alert_id,transition)
);
CREATE INDEX bell_alert_lifecycle_timeline_idx ON bell_alert_lifecycle_facts(alert_id,id);
CREATE TRIGGER bell_alert_lifecycle_no_update BEFORE UPDATE OR DELETE ON bell_alert_lifecycle_facts FOR EACH ROW EXECUTE FUNCTION bell_reject_audit_mutation();