-- §9.4 Service Interceptors M5 — per-interceptor wall-clock timeout.
--
-- An optional per-marker `timeout_ms` bounds how long ONE interceptor hook may
-- run before it is denied (a runaway guard, e.g. `loop {}`, must not hang the
-- guarded write path). NULL means "use the instance default"
-- (`PICLOUD_INTERCEPTOR_TIMEOUT_MS`). The effective deadline is always tightened
-- to at most the caller's remaining budget — a hook can never EXTEND it.
ALTER TABLE interceptors
    ADD COLUMN timeout_ms INTEGER
        CHECK (timeout_ms IS NULL OR timeout_ms > 0);
