- add sessions.record_epoch, owned by a BEFORE UPDATE trigger so the ON DELETE SET NULL path and raw SQL writes cannot skip it - normalise pre-existing rows so epoch zero means never switched - project the epoch off the row getSession already loads