Document PMA fence and migration lock cost

Define the last-binding behavior for shared definition coordinates and call out migration 0028's ACCESS EXCLUSIVE full-table rewrite before capability rollout.

Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
Signed-off-by: Wes <wesbillman@users.noreply.github.com>

docs/nips/NIP-PMA.md

@@ -107,6 +107,26 @@ same definition coordinate; each immutable aggregate revision retains its exact
 bound recovery bytes while catalog browsing reads the latest active public
 projection. Browsing never requires decrypting kind `30179`.
 
+The relay's ordinary-write fence for a `30175` definition coordinate follows
+active aggregate bindings, not retained definition revision history. When the
+last active agent bound to a definition is tombstoned, that coordinate is no
+longer PMA-authoritative and an ordinary owner-authored NIP-33 write may become
+the public head. `managed_agent_definition_heads` still retains the revision
+floor; a later aggregate rebind advances from that retained revision rather than
+adopting generic LWW history as an untracked revision. Deleted `30177` instance
+coordinates remain fenced by their deleted aggregate head, so neither ordinary
+writes nor legacy kind `5` deletion can bypass generation CAS.
+
+## Deployment note: migration 0028
+
+`0028_private_managed_agent_foundation.sql` changes `events.search_tsv` by
+dropping and re-adding the generated stored column, then rebuilding its GIN
+index. PostgreSQL performs a full `events` table rewrite while holding an
+`ACCESS EXCLUSIVE` lock. Operators MUST treat this as planned write downtime,
+size the migration window from production table/index size, and complete the
+migration before deploying binaries that advertise `nip-pma-aggregate-v1`.
+Rolling application deployment does not make this DDL online.
+
 ## Required deployment order
 
 1. **Inert reservation:** codec and kind reservation while generic ingest still