@fayz-ai/db 0.12.0 → 0.13.0

package/migrations/161_a_tenant_leaves_with_its_data.sql

@@ -0,0 +1,363 @@
+-- ---------------------------------------------------------------------------
+-- 161_a_tenant_leaves_with_its_data.sql — the two halves 155 left as settings
+-- and never built (#284).
+--
+-- 155 gave churn a mechanism: freeze for N days, then a recorded purge, with the
+-- same machine answering an LGPD erasure one level down. It named three things
+-- as configuration and shipped only the first — N is
+-- `tenants.settings.retention.freeze_days`. The other two are here.
+--
+-- ── Export on exit ─────────────────────────────────────────────────────────
+-- A customer who cancels is owed their data, and the LGPD says so in words
+-- (art. 18, V: portabilidade). Building it at purge time would be too late: the
+-- account is frozen for N days precisely so somebody can change their mind or
+-- take a copy, and a copy that only exists at the moment of deletion is not a
+-- copy, it is a race.
+--
+-- So the export is a REQUEST, made while the data is still there, drained by
+-- the same worker that drains everything else. It writes nothing itself: it
+-- lists what a tenant holds, table by table, and the worker turns that into
+-- files. A database is a bad file server and this file does not pretend
+-- otherwise.
+--
+-- ── Fiscal carve-outs ──────────────────────────────────────────────────────
+-- The purge in 155 is deliberately dumb: every table with `tenant_id`, swept
+-- until a pass moves nothing. That is what makes it complete without a
+-- hand-ordered list that stops being complete the day somebody adds a table.
+--
+-- It is also what makes it wrong in Brazil. A nota fiscal, its cancellation and
+-- the ledger behind them must survive five years whatever the customer asks —
+-- and an erasure request cannot override a retention obligation, in the LGPD's
+-- own text (art. 16, I). So the sweep learns one exception, declared as rows
+-- rather than written into the function: WHICH tables, for WHICH reason, until
+-- WHEN. A carve-out with no expiry and no citation is how "we keep everything"
+-- gets called compliance.
+-- ---------------------------------------------------------------------------
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §1  What the law makes us keep
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS app.retention_carve_outs (
+  table_name   text PRIMARY KEY,
+  reason       text NOT NULL,
+  -- The rule that requires it, so a reviewer can check rather than trust.
+  authority    text NOT NULL,
+  -- How long after the purge the rows must still exist. NULL is not allowed:
+  -- "forever" is a decision somebody has to write down as a number.
+  keep_years   integer NOT NULL CHECK (keep_years BETWEEN 1 AND 30),
+  jurisdiction text NOT NULL DEFAULT 'BR',
+  created_at   timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE app.retention_carve_outs IS
+  'Tables a tenant purge must NOT empty, with the rule that requires it and for how long (161, #284). Rows rather than code: a carve-out is a legal fact that differs per market and changes without a deploy. `authority` and `keep_years` are NOT NULL because a carve-out nobody can check is how "we keep everything" gets called compliance.';
+
+ALTER TABLE app.retention_carve_outs ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS retention_carve_outs_read ON app.retention_carve_outs;
+CREATE POLICY retention_carve_outs_read ON app.retention_carve_outs
+  FOR SELECT TO authenticated, service_role USING (true);
+GRANT SELECT ON app.retention_carve_outs TO authenticated, service_role;
+GRANT ALL ON app.retention_carve_outs TO service_role;
+
+CREATE OR REPLACE FUNCTION public.register_retention_carve_out(
+  p_table text, p_reason text, p_authority text, p_keep_years integer, p_jurisdiction text DEFAULT 'BR'
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  IF coalesce(btrim(p_authority), '') = '' THEN
+    RAISE EXCEPTION 'register_retention_carve_out: % needs the rule that requires it', p_table
+      USING ERRCODE = '22023',
+            HINT = 'Name the article, the statute or the contract clause. A carve-out nobody can check is not a carve-out.';
+  END IF;
+  INSERT INTO app.retention_carve_outs (table_name, reason, authority, keep_years, jurisdiction)
+  VALUES (p_table, p_reason, p_authority, p_keep_years, p_jurisdiction)
+  ON CONFLICT (table_name) DO UPDATE
+    SET reason = EXCLUDED.reason, authority = EXCLUDED.authority,
+        keep_years = EXCLUDED.keep_years, jurisdiction = EXCLUDED.jurisdiction;
+END $$;
+
+REVOKE ALL ON FUNCTION public.register_retention_carve_out(text, text, text, integer, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.register_retention_carve_out(text, text, text, integer, text) TO service_role;
+
+-- The carve-outs themselves are declared by the plugin that OWNS the table.
+-- They were here first, and that was wrong twice over: the base chain runs
+-- before any plugin's, so `plg_financial_movements` does not exist yet and the
+-- guard skipped every one of them — and a retention obligation is a fact about
+-- a domain, which is the plugin's to state. plugin-financial 036 declares the
+-- three Brazilian ones. What stays here is the register and the rule.
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §2  What a tenant would take with it
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS app.tenant_exports (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id    uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  requested_by uuid,
+  status       text NOT NULL DEFAULT 'requested'
+                 CHECK (status IN ('requested', 'running', 'ready', 'failed', 'expired')),
+  -- Where the worker put it. A pointer, like every other file in this platform
+  -- since 152: the bytes are storage's, the register is the base's.
+  storage_path text,
+  row_count    bigint,
+  byte_size    bigint,
+  error        text,
+  -- A download link that lives forever is a data breach with a URL.
+  expires_at   timestamptz,
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  updated_at   timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE app.tenant_exports IS
+  'Requests for a copy of everything a tenant holds (161, #284) — the portability the LGPD names (art. 18, V), made while the data still exists rather than at the moment of deletion.';
+
+CREATE INDEX IF NOT EXISTS tenant_exports_pending ON app.tenant_exports (created_at)
+  WHERE status IN ('requested', 'running');
+
+ALTER TABLE app.tenant_exports ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_exports_read ON app.tenant_exports;
+CREATE POLICY tenant_exports_read ON app.tenant_exports
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+GRANT SELECT ON app.tenant_exports TO authenticated;
+GRANT ALL ON app.tenant_exports TO service_role;
+
+DROP TRIGGER IF EXISTS tenant_exports_updated_at ON app.tenant_exports;
+CREATE TRIGGER tenant_exports_updated_at BEFORE UPDATE ON app.tenant_exports
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE OR REPLACE FUNCTION public.tenant_export_request(p_tenant uuid DEFAULT NULL)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_tenant uuid := coalesce(p_tenant, app.current_tenant_id());
+  v_id uuid;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'tenant_export_request: no tenant in scope' USING ERRCODE = '22023';
+  END IF;
+  IF auth.uid() IS NOT NULL AND NOT app.has_permission('settings.manage') THEN
+    RAISE EXCEPTION 'tenant_export_request: requires settings.manage' USING ERRCODE = '42501';
+  END IF;
+
+  -- One pending request at a time. A second one would produce a second copy of
+  -- everything, which is a cost and a second thing to expire.
+  SELECT e.id INTO v_id FROM app.tenant_exports e
+   WHERE e.tenant_id = v_tenant AND e.status IN ('requested', 'running')
+   ORDER BY e.created_at DESC LIMIT 1;
+  IF v_id IS NOT NULL THEN
+    RETURN jsonb_build_object('export_id', v_id, 'status', 'already_requested');
+  END IF;
+
+  INSERT INTO app.tenant_exports (tenant_id, requested_by, expires_at)
+  VALUES (v_tenant, auth.uid(), now() + interval '14 days')
+  RETURNING id INTO v_id;
+
+  RETURN jsonb_build_object('export_id', v_id, 'status', 'requested');
+END $$;
+
+COMMENT ON FUNCTION public.tenant_export_request(uuid) IS
+  'Asks for a copy of everything this tenant holds (161). Enqueues; the worker writes the files, because a database is a bad file server.';
+
+GRANT EXECUTE ON FUNCTION public.tenant_export_request(uuid) TO authenticated, service_role;
+
+-- What the worker reads: every tenant-scoped table and how many rows it holds
+-- for this tenant. Discovered rather than listed, for the same reason the purge
+-- sweeps rather than following a list — a hand-written manifest stops being
+-- complete the day somebody adds a table, and an incomplete export is a
+-- portability request answered wrongly.
+CREATE OR REPLACE FUNCTION public.tenant_export_manifest(p_tenant uuid)
+RETURNS TABLE (table_name text, row_count bigint, carved_out boolean)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_tbl record;
+  v_n   bigint;
+BEGIN
+  FOR v_tbl IN
+    SELECT c.relname::text AS name
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      JOIN pg_attribute a ON a.attrelid = c.oid AND a.attname = 'tenant_id' AND a.attnum > 0
+     WHERE n.nspname = 'public' AND c.relkind = 'r' AND NOT a.attisdropped
+     ORDER BY c.relname
+  LOOP
+    EXECUTE format('SELECT count(*) FROM public.%I WHERE tenant_id = $1', v_tbl.name)
+      INTO v_n USING p_tenant;
+    IF v_n = 0 THEN CONTINUE; END IF;
+    table_name := v_tbl.name;
+    row_count  := v_n;
+    carved_out := EXISTS (SELECT 1 FROM app.retention_carve_outs r WHERE r.table_name = v_tbl.name);
+    RETURN NEXT;
+  END LOOP;
+END $$;
+
+COMMENT ON FUNCTION public.tenant_export_manifest(uuid) IS
+  'Every tenant-scoped table holding rows for this tenant, with `carved_out` marking the ones a purge will leave behind (161). Discovered from the catalog, never from a list somebody maintains.';
+
+REVOKE ALL ON FUNCTION public.tenant_export_manifest(uuid) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.tenant_export_manifest(uuid) TO service_role;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §3  The purge learns the exception
+--
+-- 155's sweep is re-emitted with one change: a carved-out table is skipped, and
+-- the receipt SAYS which ones and why. A purge that silently kept rows would be
+-- worse than one that kept none — the customer was told their data was deleted.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.tenant_purge_plan(p_tenant uuid)
+RETURNS TABLE (table_name text, row_count bigint, action text, reason text)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_row record;
+BEGIN
+  FOR v_row IN SELECT * FROM public.tenant_export_manifest(p_tenant)
+  LOOP
+    table_name := v_row.table_name;
+    row_count  := v_row.row_count;
+    IF v_row.carved_out THEN
+      action := 'keep';
+      SELECT r.authority || ' — ' || r.reason INTO reason
+        FROM app.retention_carve_outs r WHERE r.table_name = v_row.table_name;
+    ELSE
+      action := 'delete';
+      reason := NULL;
+    END IF;
+    RETURN NEXT;
+  END LOOP;
+END $$;
+
+COMMENT ON FUNCTION public.tenant_purge_plan(uuid) IS
+  'What a purge would delete and what it would keep, with the rule behind each exception (161). Read before purging: an irreversible act should be previewable.';
+
+REVOKE ALL ON FUNCTION public.tenant_purge_plan(uuid) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.tenant_purge_plan(uuid) TO service_role;
+
+-- The settings a market can change without a migration, in one place, so
+-- "N days, export on exit, fiscal carve-outs" is answerable by reading rather
+-- than by grepping three functions.
+CREATE OR REPLACE VIEW public.v_retention_policy
+WITH (security_invoker = true) AS
+  SELECT t.id AS tenant_id,
+         coalesce((t.settings #>> '{retention,freeze_days}')::int, 90) AS freeze_days,
+         coalesce((t.settings #>> '{retention,export_on_exit}')::boolean, true) AS export_on_exit,
+         (SELECT count(*) FROM app.retention_carve_outs) AS carve_out_count,
+         (SELECT max(r.keep_years) FROM app.retention_carve_outs r) AS longest_carve_out_years
+    FROM public.tenants t;
+
+COMMENT ON VIEW public.v_retention_policy IS
+  'The three retention settings per tenant (161, #284): how long a frozen account is kept, whether it is exported on the way out, and how many tables the law makes us keep regardless.';
+
+GRANT SELECT ON public.v_retention_policy TO authenticated, service_role;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §4  The purge, re-emitted with the exception
+--
+-- 155's sweep, unchanged in shape — every table carrying `tenant_id`, repeated
+-- until a pass moves nothing — plus one skip and one honest receipt. The whole
+-- body is re-emitted rather than patched because a function has no partial
+-- edit, and copying it is what makes the diff show exactly which two lines are
+-- new.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.tenant_purge(p_tenant uuid, p_confirm text DEFAULT NULL)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_state   text;
+  v_table   record;
+  v_deleted bigint;
+  v_total   bigint := 0;
+  v_receipt jsonb := '{}'::jsonb;
+  v_kept    jsonb := '{}'::jsonb;
+  v_pass    integer := 0;
+  v_moved   boolean := true;
+BEGIN
+  -- Two locks on the door, because this one has no undo.
+  IF p_confirm IS DISTINCT FROM p_tenant::text THEN
+    RAISE EXCEPTION 'tenant_purge: confirm must repeat the tenant id — this cannot be undone'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT state INTO v_state FROM app.tenant_lifecycle WHERE tenant_id = p_tenant;
+  IF v_state IS DISTINCT FROM 'frozen' THEN
+    RAISE EXCEPTION 'tenant_purge: % is not frozen (state %) — freeze first', p_tenant, coalesce(v_state, 'active')
+      USING ERRCODE = '23514',
+            HINT = 'The freeze is what gives a customer the window to change their mind.';
+  END IF;
+
+  -- What the law makes us keep, counted BEFORE anything is deleted, so the
+  -- receipt can say what survived and why. A purge that silently kept rows
+  -- would be worse than one that kept none: the customer was told otherwise.
+  FOR v_table IN
+    SELECT r.table_name, r.authority, r.reason FROM app.retention_carve_outs r
+  LOOP
+    IF to_regclass('public.' || quote_ident(v_table.table_name)) IS NULL THEN CONTINUE; END IF;
+    EXECUTE format('SELECT count(*) FROM public.%I WHERE tenant_id = $1', v_table.table_name)
+      INTO v_deleted USING p_tenant;
+    IF v_deleted > 0 THEN
+      v_kept := v_kept || jsonb_build_object(v_table.table_name,
+        jsonb_build_object('rows', v_deleted, 'authority', v_table.authority, 'reason', v_table.reason));
+    END IF;
+  END LOOP;
+
+  WHILE v_moved AND v_pass < 12 LOOP
+    v_moved := false;
+    v_pass := v_pass + 1;
+    FOR v_table IN
+      SELECT c.relname AS table_name, n.nspname AS schema_name
+        FROM pg_class c
+        JOIN pg_namespace n ON n.oid = c.relnamespace
+        JOIN information_schema.columns col
+          ON col.table_schema = n.nspname AND col.table_name = c.relname AND col.column_name = 'tenant_id'
+       WHERE c.relkind = 'r'
+         AND n.nspname IN ('public', 'app')
+         AND c.relname <> 'tenants'
+         AND c.relname <> 'tenant_lifecycle'
+         -- THE ONE NEW LINE. A fiscal obligation is not a preference, and an
+         -- erasure request cannot override a retention duty (LGPD art. 16, I).
+         AND NOT EXISTS (
+           SELECT 1 FROM app.retention_carve_outs r
+            WHERE r.table_name = c.relname AND n.nspname = 'public'
+         )
+       ORDER BY c.relname
+    LOOP
+      BEGIN
+        EXECUTE format('DELETE FROM %I.%I WHERE tenant_id = $1', v_table.schema_name, v_table.table_name)
+          USING p_tenant;
+        GET DIAGNOSTICS v_deleted = ROW_COUNT;
+        IF v_deleted > 0 THEN
+          v_moved := true;
+          v_total := v_total + v_deleted;
+          v_receipt := v_receipt || jsonb_build_object(
+            v_table.schema_name || '.' || v_table.table_name,
+            coalesce((v_receipt ->> (v_table.schema_name || '.' || v_table.table_name))::bigint, 0) + v_deleted);
+        END IF;
+      EXCEPTION WHEN foreign_key_violation THEN
+        -- Its parent is still there; the next pass will find it empty.
+        NULL;
+      END;
+    END LOOP;
+  END LOOP;
+
+  UPDATE app.tenant_lifecycle
+     SET state = 'purged', purged_at = now()
+   WHERE tenant_id = p_tenant;
+
+  RETURN jsonb_build_object('tenant_id', p_tenant, 'rows_deleted', v_total, 'passes', v_pass,
+                            'receipt', v_receipt,
+                            -- AND the second half of the truth.
+                            'kept_by_law', v_kept);
+END $$;
+
+COMMENT ON FUNCTION public.tenant_purge(uuid, text) IS
+  'Deletes everything a frozen tenant owns EXCEPT what a retention rule requires kept, with a receipt for both halves (155 + 161). Deliberately dumb — every table carrying tenant_id, swept until a pass moves nothing — because a curated list stops being complete the day someone adds a table. `kept_by_law` names each exception and its authority: a purge that silently kept rows would be worse than one that kept none.';
+
+REVOKE ALL ON FUNCTION public.tenant_purge(uuid, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.tenant_purge(uuid, text) TO service_role;

package/migrations/162_every_name_has_one_creator_for_real.sql

@@ -0,0 +1,126 @@
+-- ---------------------------------------------------------------------------
+-- 162_every_name_has_one_creator_for_real.sql — the nine names the ownership
+-- gate was still carrying as exemptions (#285, #282).
+--
+-- 148 stated the rule — one creator per table name — and shipped it with nine
+-- declared exemptions, each one a real violation triaged and not fixed in the
+-- same commit. A gate that starts red is a gate nobody turns on, so declaring
+-- them was right. Leaving them declared forever would not be: an exemption that
+-- outlives its author is a rule nobody enforces.
+--
+-- The nine are three different problems, and they get three different answers.
+--
+-- ── 1. Names the BASE took over (2) ────────────────────────────────────────
+-- `public.documents` was created by plugin-forms and adopted by the base in 152
+-- (#282, ADR 0020); `public.event_log` was created by plugin-automations and is
+-- the base's since #277. Both plugins still carry a `CREATE TABLE IF NOT
+-- EXISTS` for them, and that CREATE is now a guarded no-op — it exists so a
+-- pool that ran the plugin BEFORE the base adopted the name still converges.
+--
+-- Deleting those lines is not available: a migration is never edited after it
+-- has been applied, because the ledger treats checksum drift on an applied file
+-- as a hard stop. So the base RECORDS the adoption, and the gate reads the
+-- record — the same move 148 made for `app.base_owned_tables` and 158 for a
+-- retired constraint. A guarded CREATE of an adopted name is history; an
+-- unguarded one, or a CREATE of a name nobody adopted, still fails.
+--
+-- ── 2. Shop tables that predate the prefix rule (4) ────────────────────────
+-- `payment_methods`, `fulfillments`, `fulfillment_items` and `order_events` are
+-- the shop's own data wearing base-looking names. 141's mechanism applies
+-- exactly: rename under the prefix, leave a view answering to the old name, and
+-- no deploy has to be synchronised.
+--
+-- ── 3. Names 148 already moved (3) ─────────────────────────────────────────
+-- `shipping_zones` and `shipping_settings` moved in 148 and `addresses` has
+-- been base-owned since 017 — the shop's CREATEs for all three are the same
+-- guarded no-op as case 1, and are recorded the same way.
+-- ---------------------------------------------------------------------------
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §1  The register: which names changed hands, and how
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS app.adopted_table_names (
+  table_name    text PRIMARY KEY,
+  former_creator text NOT NULL,
+  new_owner     text NOT NULL,
+  adopted_in    text NOT NULL,
+  disposition   text NOT NULL CHECK (disposition IN ('adopted', 'renamed')),
+  note          text NOT NULL,
+  created_at    timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE app.adopted_table_names IS
+  'Table names whose creator changed (162): adopted by the base, or renamed under a plugin prefix. The review gate reads this so a plugin''s historical guarded CREATE can be told apart from a new violation — the same discipline as app.base_owned_tables (148) and app.retired_base_constraints (158).';
+
+ALTER TABLE app.adopted_table_names ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS adopted_table_names_read ON app.adopted_table_names;
+CREATE POLICY adopted_table_names_read ON app.adopted_table_names
+  FOR SELECT TO authenticated, service_role USING (true);
+GRANT SELECT ON app.adopted_table_names TO authenticated, service_role;
+GRANT ALL ON app.adopted_table_names TO service_role;
+
+INSERT INTO app.adopted_table_names (table_name, former_creator, new_owner, adopted_in, disposition, note) VALUES
+  ('documents', 'forms', 'base', '152', 'adopted',
+   'The File archetype (#282, ADR 0020). plugin-forms created a base-looking name, so a pool without forms had no attachments at all. The base adopted the table and left the data alone — forms keeps a guarded CREATE for pools that ran it first.'),
+  ('event_log', 'automations', 'base', '027/149', 'adopted',
+   'The domain-event log the base owns since #277. The plugin copy is a guarded no-op that converges a pool which ran automations before the base had the table.'),
+  ('addresses', 'shop', 'base', '017', 'adopted',
+   'Base-owned since 017_core_addresses: an address is a fact about a business, not about a shop. The shop CREATE is a guarded duplicate.'),
+  ('shipping_zones', 'shop', 'shop', '148', 'renamed',
+   'Moved to plg_shop_shipping_zones by 148 with a compat view. The old CREATE is history.'),
+  ('shipping_settings', 'shop', 'shop', '148', 'renamed',
+   'Moved to plg_shop_shipping_settings by 148 with a compat view. The old CREATE is history.'),
+  ('payment_methods', 'shop', 'shop', '162', 'renamed',
+   'Which cards a store accepts is a fact about running that shop. Renamed under the prefix here, with a compat view.'),
+  ('fulfillments', 'shop', 'shop', '162', 'renamed',
+   'A fulfilment is the shop''s own record of a dispatch. Renamed under the prefix here.'),
+  ('fulfillment_items', 'shop', 'shop', '162', 'renamed',
+   'Its lines. Renamed with it.'),
+  ('order_events', 'shop', 'shop', '162', 'renamed',
+   'The shop''s per-order timeline — NOT the domain-event log, despite the name, which is precisely why it should not have worn one that reads like the base''s.')
+ON CONFLICT (table_name) DO UPDATE
+  SET former_creator = EXCLUDED.former_creator, new_owner = EXCLUDED.new_owner,
+      adopted_in = EXCLUDED.adopted_in, disposition = EXCLUDED.disposition, note = EXCLUDED.note;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §2  The four that still need moving live in the SHOP's chain
+--
+-- They were here first, and that was wrong: the base chain runs before any
+-- plugin's, so at this point `public.payment_methods` does not exist yet and
+-- the rename found nothing to move. A migration that silently does nothing is
+-- worse than one that fails — it leaves the register above claiming a rename
+-- that never happened.
+--
+-- So the rename is `packages/shop/migrations/0087`, which runs after the tables
+-- it renames. What stays here is the DECLARATION, which is the base's business
+-- and is what the review gate reads.
+-- ─────────────────────────────────────────────────────────────────────────
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §3  The census
+--
+-- An unprefixed name in `public` that neither the base claims (148) nor the
+-- adoption register explains (this file) is a new violation. Zero rows is the
+-- expected reading, and the reading is available from the database rather than
+-- only from CI — a pool carries tables from versions the repository has moved
+-- past.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE VIEW public.v_unclaimed_table_names
+WITH (security_invoker = true) AS
+  SELECT c.relname::text AS table_name
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+   WHERE n.nspname = 'public'
+     AND c.relkind = 'r'
+     AND c.relname NOT LIKE 'plg\_%'
+     AND c.relname NOT LIKE '\_%'
+     AND NOT EXISTS (SELECT 1 FROM app.base_owned_tables b WHERE b.table_name = c.relname)
+     AND NOT EXISTS (SELECT 1 FROM app.adopted_table_names a WHERE a.table_name = c.relname)
+   ORDER BY c.relname;
+
+COMMENT ON VIEW public.v_unclaimed_table_names IS
+  'Unprefixed tables in public that neither the base claims (148) nor the adoption register explains (162). A row here is a name with no declared creator — the thing "one creator per table name" exists to prevent.';
+
+GRANT SELECT ON public.v_unclaimed_table_names TO authenticated, service_role;