@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/103_migration_reconcile_ponr.sql

@@ -1,132 +0,0 @@
--- ============================================================================
--- 103_migration_reconcile_ponr.sql — the reconciliation report (PRD 10 R6)
--- and the point-of-no-return stamp (ADR 0008).
---
--- reconcile(batch): counts per source table, a checksum over the tenant's
--- ledger rows (stable across a replay), FK sanity (migrated target ids that no
--- longer exist), financial sums Σ(ledger) vs Σ(destination) per (table, column)
--- to the cent unless an approved exception covers the key, open quarantines and
--- pending rows. green ⇔ nothing open, nothing missing, every sum matches (or is
--- excepted), nothing pending. Stored in migration.reconciliation_reports.
---
--- PONR: the first write to a fenced tenant's business data by anyone who is
--- NOT the migration stamps tenant_fence.first_v2_write_at; from then on the
--- kill switch refuses. Canonical stamp: AFTER row triggers on public.orders and
--- public.people (cheap: one GUC read, one PK lookup) — the two tables every
--- V2 session writes first. migration.mark_v2_write(tenant) is the explicit
--- form for a service that knows it wrote as V2.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION migration.reconcile(p_batch uuid) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  b migration.batches%ROWTYPE;
-  v_batch_counts jsonb; v_tenant_counts jsonb; v_checksum text;
-  v_fk jsonb := '[]'::jsonb; v_fk_missing integer := 0; v_fk_checked integer := 0;
-  v_values jsonb := '[]'::jsonb; v_value_mismatch integer := 0;
-  v_quar jsonb; v_quar_open integer; v_exceptions jsonb; v_pending integer;
-  v_green boolean; v_report jsonb; v_id uuid;
-  r record; v_missing integer; v_sample jsonb; v_dest numeric; v_led numeric; v_exc boolean; v_match boolean;
-BEGIN
-  SELECT * INTO b FROM migration.batches WHERE id = p_batch;
-  IF NOT FOUND THEN RAISE EXCEPTION 'reconcile: unknown batch %', p_batch USING ERRCODE = 'P0002'; END IF;
-
-  SELECT coalesce(jsonb_object_agg(source_table, c), '{}'::jsonb) INTO v_batch_counts
-    FROM (SELECT source_table, jsonb_object_agg(status, n) AS c
-            FROM (SELECT source_table, status, count(*) AS n FROM migration.ledger WHERE batch_id = p_batch GROUP BY 1, 2) s
-           GROUP BY source_table) t;
-  SELECT coalesce(jsonb_object_agg(source_table, c), '{}'::jsonb) INTO v_tenant_counts
-    FROM (SELECT source_table, jsonb_object_agg(status, n) AS c
-            FROM (SELECT source_table, status, count(*) AS n FROM migration.ledger
-                   WHERE tenant_id = b.tenant_id AND source_project = b.source_project GROUP BY 1, 2) s
-           GROUP BY source_table) t;
-  SELECT md5(coalesce(string_agg(
-           concat_ws('|', source_table, source_numeric_id, source_uuid, target_table, target_id, status, checksum, cursor), E'\n'
-           ORDER BY source_table, source_numeric_id, source_uuid, target_table), ''))
-    INTO v_checksum
-    FROM migration.ledger WHERE tenant_id = b.tenant_id AND source_project = b.source_project;
-
-  FOR r IN SELECT target_table, count(*) AS n FROM migration.ledger
-            WHERE tenant_id = b.tenant_id AND source_project = b.source_project AND status = 'migrated'
-              AND target_table IS NOT NULL AND target_id IS NOT NULL
-            GROUP BY 1 ORDER BY 1 LOOP
-    v_fk_checked := v_fk_checked + r.n;
-    IF to_regclass(r.target_table) IS NULL THEN
-      v_fk := v_fk || jsonb_build_object('target_table', r.target_table, 'checked', r.n, 'missing', r.n, 'note', 'destination table absent');
-      v_fk_missing := v_fk_missing + r.n;
-      CONTINUE;
-    END IF;
-    EXECUTE format('SELECT count(*) FROM (SELECT DISTINCT l.target_id FROM migration.ledger l WHERE l.tenant_id = $1 AND l.source_project = $2 AND l.status = ''migrated'' AND l.target_table = $3) l LEFT JOIN %s d ON d.id = l.target_id WHERE d.id IS NULL', r.target_table)
-      INTO v_missing USING b.tenant_id, b.source_project, r.target_table;
-    EXECUTE format('SELECT coalesce(jsonb_agg(x), ''[]''::jsonb) FROM (SELECT l.target_id AS x FROM (SELECT DISTINCT l.target_id FROM migration.ledger l WHERE l.tenant_id = $1 AND l.source_project = $2 AND l.status = ''migrated'' AND l.target_table = $3) l LEFT JOIN %s d ON d.id = l.target_id WHERE d.id IS NULL LIMIT 20) s', r.target_table)
-      INTO v_sample USING b.tenant_id, b.source_project, r.target_table;
-    v_fk := v_fk || jsonb_build_object('target_table', r.target_table, 'checked', r.n, 'missing', v_missing, 'sample', v_sample);
-    v_fk_missing := v_fk_missing + v_missing;
-  END LOOP;
-
-  FOR r IN SELECT l.target_table, k AS col FROM migration.ledger l, LATERAL jsonb_object_keys(l.financial) k
-            WHERE l.tenant_id = b.tenant_id AND l.source_project = b.source_project AND l.status = 'migrated' AND l.financial IS NOT NULL
-            GROUP BY 1, 2 ORDER BY 1, 2 LOOP
-    SELECT coalesce(sum((financial ->> r.col)::numeric), 0) INTO v_led FROM migration.ledger
-     WHERE tenant_id = b.tenant_id AND source_project = b.source_project AND status = 'migrated' AND target_table = r.target_table AND financial ? r.col;
-    IF to_regclass(r.target_table) IS NULL OR NOT migration._has_column(r.target_table, r.col) THEN
-      v_dest := NULL;
-    ELSE
-      EXECUTE format('SELECT coalesce(sum(d.%I), 0) FROM %s d WHERE d.id IN (SELECT DISTINCT l.target_id FROM migration.ledger l WHERE l.tenant_id = $1 AND l.source_project = $2 AND l.status = ''migrated'' AND l.target_table = $3 AND l.financial ? $4)', r.col, r.target_table)
-        INTO v_dest USING b.tenant_id, b.source_project, r.target_table, r.col;
-    END IF;
-    v_exc := EXISTS (SELECT 1 FROM migration.exceptions e WHERE e.tenant_id = b.tenant_id AND e.key = r.target_table || '.' || r.col AND (e.batch_id IS NULL OR e.batch_id = p_batch));
-    v_match := v_dest IS NOT NULL AND round(v_led, 2) = round(v_dest, 2);
-    IF NOT v_match AND NOT v_exc THEN v_value_mismatch := v_value_mismatch + 1; END IF;
-    v_values := v_values || jsonb_build_object('target_table', r.target_table, 'column', r.col, 'ledger_sum', round(v_led, 2),
-                                               'destination_sum', round(v_dest, 2), 'match', v_match, 'exception', v_exc);
-  END LOOP;
-
-  SELECT coalesce(sum(n), 0)::integer, coalesce(jsonb_object_agg(kind, n), '{}'::jsonb) INTO v_quar_open, v_quar
-    FROM (SELECT q.kind, count(*) AS n FROM migration.quarantine q JOIN migration.ledger l ON l.id = q.ledger_id
-           WHERE l.tenant_id = b.tenant_id AND l.source_project = b.source_project AND q.resolved_at IS NULL GROUP BY q.kind) s;
-  SELECT count(*)::integer INTO v_pending FROM migration.ledger
-   WHERE tenant_id = b.tenant_id AND source_project = b.source_project AND status = 'pending';
-  SELECT coalesce(jsonb_agg(jsonb_build_object('id', e.id, 'source_table', e.source_table, 'key', e.key, 'reason', e.reason, 'approved_by', e.approved_by, 'approved_at', e.approved_at) ORDER BY e.id), '[]'::jsonb)
-    INTO v_exceptions FROM migration.exceptions e WHERE e.tenant_id = b.tenant_id AND (e.batch_id IS NULL OR e.batch_id = p_batch);
-
-  v_green := v_quar_open = 0 AND v_fk_missing = 0 AND v_value_mismatch = 0 AND v_pending = 0;
-  v_report := jsonb_build_object(
-    'batch', jsonb_build_object('id', b.id, 'status', b.status, 'source_project', b.source_project, 'source_tenant_id', b.source_tenant_id,
-                                'cursor_from', b.cursor_from, 'cursor_to', b.cursor_to, 'outcomes', b.counts, 'rows', v_batch_counts),
-    'tenant', jsonb_build_object('tenant_id', b.tenant_id, 'source_project', b.source_project, 'counts', v_tenant_counts, 'checksum', v_checksum,
-                                 'fk', jsonb_build_object('checked', v_fk_checked, 'missing', v_fk_missing, 'by_table', v_fk),
-                                 'values', v_values, 'quarantine', jsonb_build_object('open', v_quar_open, 'by_kind', v_quar),
-                                 'pending', v_pending, 'exceptions', v_exceptions),
-    'green', v_green, 'generated_at', now());
-  INSERT INTO migration.reconciliation_reports (tenant_id, batch_id, green, report) VALUES (b.tenant_id, p_batch, v_green, v_report) RETURNING id INTO v_id;
-  RETURN v_report || jsonb_build_object('report_id', v_id);
-END $$;
-REVOKE ALL ON FUNCTION migration.reconcile(uuid) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION migration.reconcile(uuid) TO service_role;
-
--- ─────────────────────────────── PONR stamp ────────────────────────────
-CREATE OR REPLACE FUNCTION migration.trg_ponr_stamp() RETURNS trigger
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE v_tenant uuid;
-BEGIN
-  IF coalesce(current_setting('migration.writer', true), '') = 'on' THEN RETURN NULL; END IF;
-  v_tenant := CASE WHEN TG_OP = 'DELETE' THEN OLD.tenant_id ELSE NEW.tenant_id END;
-  IF v_tenant IS NOT NULL THEN
-    UPDATE migration.tenant_fence SET first_v2_write_at = now()
-     WHERE tenant_id = v_tenant AND first_v2_write_at IS NULL AND state IN ('fenced', 'v2_writer');
-  END IF;
-  RETURN NULL;
-END $$;
-REVOKE ALL ON FUNCTION migration.trg_ponr_stamp() FROM public, anon, authenticated;
-
-DO $$
-DECLARE t text;
-BEGIN
-  FOREACH t IN ARRAY ARRAY['orders', 'people'] LOOP
-    IF to_regclass('public.' || t) IS NOT NULL THEN
-      EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', t || '_migration_ponr', t);
-      EXECUTE format('CREATE TRIGGER %I AFTER INSERT OR UPDATE OR DELETE ON public.%I FOR EACH ROW EXECUTE FUNCTION migration.trg_ponr_stamp()', t || '_migration_ponr', t);
-    END IF;
-  END LOOP;
-END $$;

package/migrations/105_policies_to_authenticated.sql

@@ -1,71 +0,0 @@
--- ============================================================================
--- 105_policies_to_authenticated.sql — no policy without `TO authenticated` (#147).
---
--- The 001-era policies were written FOR PUBLIC (no role clause): audit_logs,
--- invitations, invoices, notifications, profiles, subscriptions, tenants,
--- tenant_members/locations (compat views since #134), tenant_role*. A policy
--- applying to PUBLIC is evaluated for anon too, and every new table born with
--- a PUBLIC policy widens the anonymous surface by accident. The rule of the
--- authz spec (§7, non-negotiable) is `to authenticated` on every policy; the
--- verification suite (900_verification/001_posture) grades it, so this file
--- re-creates each remaining PUBLIC policy with the same predicate, scoped to
--- authenticated. Dynamic and idempotent: a policy that is already role-scoped
--- is untouched, and re-running finds nothing to do.
---
--- Anon never loses anything it should keep: the core chain has no anonymous
--- read surface on these tables (the storefront/booking anon paths live in the
--- shop/agenda plugins and are named `_anon_*` policies with an explicit role).
--- ============================================================================
-DO $$
-DECLARE r record; v_cmd text;
-BEGIN
-  FOR r IN
-    SELECT schemaname, tablename, policyname, permissive, cmd, qual, with_check
-      FROM pg_policies
-     WHERE roles = '{public}'
-       AND (schemaname = 'app'
-            -- the generic isolation policies 002 stamps on every public table with a
-            -- tenant_id (including plugin tables it discovers on a re-run): same
-            -- predicate, so scoping them to authenticated changes nothing for a
-            -- signed-in user and closes the anonymous evaluation
-            OR policyname LIKE 'tenant\_isolation\_%'
-            -- the spine's own 001-era tables only: a plugin (shop, agenda…) that
-            -- deliberately opened a PUBLIC read policy for its anonymous surface is
-            -- its own decision, and this file must converge the same way whether it
-            -- runs before or after that plugin's migrations
-            OR (schemaname = 'public' AND tablename IN (
-                 'tenants', 'profiles', 'tenant_members', 'plans', 'permissions', 'role_permissions',
-                 'tenant_role_overrides', 'tenant_roles', 'invitations', 'payment_events', 'locations',
-                 'location_members', 'audit_logs', 'subscriptions', 'invoices', 'notifications',
-                 'fayz_projects', 'addresses')))
-  LOOP
-    v_cmd := format('CREATE POLICY %I ON %I.%I AS %s FOR %s TO authenticated',
-                    r.policyname, r.schemaname, r.tablename,
-                    CASE WHEN r.permissive = 'PERMISSIVE' THEN 'PERMISSIVE' ELSE 'RESTRICTIVE' END,
-                    r.cmd);
-    IF r.qual IS NOT NULL THEN v_cmd := v_cmd || format(' USING (%s)', r.qual); END IF;
-    IF r.with_check IS NOT NULL THEN v_cmd := v_cmd || format(' WITH CHECK (%s)', r.with_check); END IF;
-    EXECUTE format('DROP POLICY IF EXISTS %I ON %I.%I', r.policyname, r.schemaname, r.tablename);
-    EXECUTE v_cmd;
-  END LOOP;
-END $$;
-
--- ── anon executes nothing in schema app ─────────────────────────────────
--- Functions in `app` are born with the built-in default (EXECUTE to PUBLIC);
--- 050's per-schema default-privilege REVOKE cannot subtract it, so every helper
--- has to revoke explicitly. One slipped (a hashing helper). Sweep the schema so
--- the rule holds regardless of who forgets: nothing callable in `app` for anon
--- or PUBLIC; the intended callers (authenticated/service_role) keep what they
--- were granted explicitly. Trigger functions cannot be called directly anyway.
-DO $$
-DECLARE r record;
-BEGIN
-  FOR r IN
-    SELECT p.oid::regprocedure AS sig
-      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-     WHERE n.nspname = 'app'
-       AND has_function_privilege('anon', p.oid, 'EXECUTE')
-  LOOP
-    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon', r.sig);
-  END LOOP;
-END $$;

package/migrations/106_function_search_path.sql

@@ -1,55 +0,0 @@
--- ============================================================================
--- 106_function_search_path.sql — every function in public/app/migration gets a
--- fixed search_path.
---
--- Found by applying the canonical chain to a real Supabase project (the
--- rehearsal, 2026-08-19): the platform's own linter flags 25 functions whose
--- search_path is resolved from the caller's session. For a SECURITY DEFINER
--- function that is a privilege-escalation vector — a caller who can create an
--- object in a schema earlier on the path decides what an unqualified name in
--- the body means. `public.handle_new_user` (spine 001, runs on every signup)
--- was the one definer in that state; the rest are trigger and helper functions
--- where it is a lint rather than a hole, but the rule is cheap to hold.
---
--- Done as ALTER, not CREATE OR REPLACE: the bodies are not touched, so this
--- cannot change behaviour beyond making name resolution deterministic. The
--- path pinned per schema is the one those bodies already resolve through
--- (their own schema first, then public and extensions), so unqualified
--- references keep meaning what they mean today. Functions that already declare
--- a search_path — every RPC this phase adds declares `SET search_path = ''` —
--- are left alone.
---
--- Idempotent: re-running finds nothing without a search_path and does nothing.
--- ============================================================================
-DO $$
-DECLARE
-  r record;
-  v_path text;
-BEGIN
-  FOR r IN
-    SELECT p.oid, n.nspname, p.oid::regprocedure AS sig, p.prosecdef
-      FROM pg_proc p
-      JOIN pg_namespace n ON n.oid = p.pronamespace
-     WHERE n.nspname IN ('public', 'app', 'migration')
-       AND p.prokind = 'f'
-       AND NOT EXISTS (
-             SELECT 1 FROM unnest(coalesce(p.proconfig, '{}')) c WHERE c LIKE 'search_path=%')
-       -- NOT OURS TO PIN. An extension installed into public brings its own
-       -- functions with it — school has btree_gist, so gbt_date_penalty and
-       -- friends sit in public owned by a superuser, and the sweep stops on
-       -- "must be owner of function". Even with the rights it would be the wrong
-       -- move: those bodies belong to the extension, its next upgrade rewrites
-       -- them, and the lint they trip is the extension author's to answer.
-       AND NOT EXISTS (
-             SELECT 1 FROM pg_depend d
-              WHERE d.objid = p.oid AND d.classid = 'pg_proc'::regclass AND d.deptype = 'e')
-       -- and never a function this role cannot alter, whatever brought it here.
-       AND pg_catalog.pg_has_role(p.proowner, 'USAGE')
-  LOOP
-    v_path := CASE r.nspname
-                WHEN 'public' THEN 'public, extensions, pg_temp'
-                ELSE format('%I, public, extensions, pg_temp', r.nspname)
-              END;
-    EXECUTE format('ALTER FUNCTION %s SET search_path = %s', r.sig, v_path);
-  END LOOP;
-END $$;

package/migrations/107_core_table_prefix.sql

@@ -1,361 +0,0 @@
--- ============================================================================
--- 107_core_table_prefix.sql — eight core tables drop the `plg_` prefix.
---
--- `plg_` means "owned by plugin <name>": docs/plugins/PLUGIN-CONVENTION.md §3
--- reads every table a plugin owns as `plg_<plugin>_*`, and
--- scripts/emit-plg-census.mjs is the ledger of that rule. Eight tables of the
--- CORE SPINE wear the prefix with no plugin segment at all, so the name claims
--- an owner that does not exist and the census has to special-case them:
---
---   plg_analytics_read_models  → analytics_read_models    (024)
---   plg_connections            → connections             (029)
---   plg_connection_secrets     → connection_secrets       (032)
---   plg_connector_schedules    → connector_schedules      (033)
---   plg_entity_fields          → entity_fields            (035)
---   plg_event_log              → event_log                (027)
---   plg_sync_runs              → sync_runs                (029)
---   plg_sync_schedule          → sync_schedule            (033)
---
--- WHY THIS FILE AND NOT AN EDIT OF 024/027/029/031/032/033/035. Those files are
--- applied in production pools; an applied migration is never edited (the ledger
--- turns an edit into a hard stop). The rename is therefore additive: the frozen
--- files keep creating the old names on a pool that has never seen them, and
--- this file carries them over.
---
--- WHY NO COMPAT VIEWS UNDER THE OLD NAMES. The tenancy retirement
--- (063_legacy_tenancy_retired.sql) proved that shape impossible here: on the
--- bench's force-replay pass the frozen files re-run and execute
--- `ALTER TABLE public.plg_x ENABLE ROW LEVEL SECURITY`, `ADD COLUMN IF NOT
--- EXISTS`, `CREATE POLICY … ON public.plg_x` — every one of which errors with
--- "this operation is not supported for views". 053 answered that with
--- projection TABLES because the legacy names had to keep taking writes. Here
--- they must not: the whole point is that the old name stops existing.
---
--- WHAT A REPLAY LOOKS LIKE. On a re-apply the frozen files run again and
--- `CREATE TABLE IF NOT EXISTS public.plg_x` re-creates the old name EMPTY,
--- beside the renamed one that holds the data. So each table has exactly three
--- states and this file handles all three:
---
---   1. old exists, new does not  → ALTER TABLE … RENAME TO. The data, indexes,
---      constraints, policies, grants and dependent FKs all travel with it.
---   2. both exist                → the old one can only be that empty
---      re-creation. DROP it when it has zero rows; RAISE EXCEPTION when it has
---      any, because a pool with a live writer on the old name must fail loudly
---      rather than lose rows.
---   3. neither/only the new one  → nothing to do. Re-running is a no-op.
---
--- plg_event_log is ALSO declared by plugins/plugin-automations 0002_event_log
--- ("core table also CREATEd by this plugin" in the census). That file is
--- applied too and is not edited: its `CREATE TABLE IF NOT EXISTS` is a no-op on
--- a pool that has 027, and where it does re-create the empty duplicate this
--- file drops it by branch 2. THE CORE OWNS event_log — 027 is the definition,
--- automations is a legacy first writer.
---
--- SCOPE: TABLES ONLY. The core functions that carry the same prefix
--- (plg_emit_event, plg_claim_effect, plg_settle_effect, plg_prune_sync_runs,
--- plg_store_connection_secret, plg_read_connection_secret,
--- plg_drop_connection_secrets, plg_register_connector_schedule,
--- plg_set_scheduler_endpoint, plg_sync_tick, plg_emit_row_event,
--- plg_attach_event_source) are called by name from TypeScript and from edge
--- functions that are already DEPLOYED, so renaming them is a separate wave —
--- see docs/data/phase-0/12-core-table-prefix.md. Their BODIES are repointed
--- here (§3), because a body still naming plg_connections is a runtime error the
--- moment the table is gone.
--- ============================================================================
-
--- ── §1  the tables ──────────────────────────────────────────────────────────
-DO $$
-DECLARE
-  -- Children before parents, so a duplicate is dropped before the duplicate it
-  -- references (plg_connection_secrets / plg_sync_runs / plg_sync_schedule all
-  -- FK plg_connections).
-  v_pairs text[][] := ARRAY[
-    ['plg_connection_secrets',    'connection_secrets'],
-    ['plg_sync_runs',             'sync_runs'],
-    ['plg_sync_schedule',         'sync_schedule'],
-    ['plg_connections',           'connections'],
-    ['plg_connector_schedules',   'connector_schedules'],
-    ['plg_analytics_read_models', 'analytics_read_models'],
-    ['plg_entity_fields',         'entity_fields'],
-    ['plg_event_log',             'event_log']
-  ];
-  i      integer;
-  v_old  text;
-  v_new  text;
-  v_rows bigint;
-BEGIN
-  -- Pass A — branch 2: the empty re-creation left by a replay of the frozen file.
-  FOR i IN 1 .. array_length(v_pairs, 1) LOOP
-    v_old := v_pairs[i][1];
-    v_new := v_pairs[i][2];
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_old)) IS NULL;
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_new)) IS NULL;
-
-    EXECUTE format('SELECT count(*) FROM public.%I', v_old) INTO v_rows;
-    IF v_rows > 0 THEN
-      RAISE EXCEPTION
-        'public.% still holds % row(s) while public.% exists: something is still WRITING the old name. Point that writer at public.% and move the rows across before re-applying 097 — this migration will not drop data.',
-        v_old, v_rows, v_new, v_new
-        USING ERRCODE = 'raise_exception';
-    END IF;
-
-    EXECUTE format('DROP TABLE public.%I', v_old);
-    RAISE NOTICE '097: dropped the empty re-creation public.% (public.% is the table)', v_old, v_new;
-  END LOOP;
-
-  -- Pass B — branch 1: the rename that carries everything.
-  FOR i IN 1 .. array_length(v_pairs, 1) LOOP
-    v_old := v_pairs[i][1];
-    v_new := v_pairs[i][2];
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_old)) IS NULL;
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_new)) IS NOT NULL;
-
-    EXECUTE format('ALTER TABLE public.%I RENAME TO %I', v_old, v_new);
-    RAISE NOTICE '097: renamed public.% → public.%', v_old, v_new;
-  END LOOP;
-END $$;
-
--- ── §2  the names bolted to those tables ────────────────────────────────────
--- A rename leaves every index, constraint, trigger and policy under its old
--- name, so `\d connections` would still read plg_. Each is renamed by dropping the
--- `plg_` segment, and only when the target name is free — on a replay the
--- frozen file has re-created the old names on the (already dropped) duplicate,
--- so this loop simply finds nothing left to do.
-DO $$
-DECLARE
-  v_tables text[] := ARRAY[
-    'analytics_read_models', 'connection_secrets', 'connections', 'connector_schedules',
-    'entity_fields', 'event_log', 'sync_runs', 'sync_schedule'
-  ];
-  r     record;
-  v_new text;
-BEGIN
-  -- Constraints first: renaming a PRIMARY KEY / UNIQUE constraint renames the
-  -- index behind it, so the index loop below then has nothing to say about it.
-  FOR r IN
-    SELECT c.conname, t.relname AS tbl
-      FROM pg_constraint c
-      JOIN pg_class t     ON t.oid = c.conrelid
-      JOIN pg_namespace n ON n.oid = t.relnamespace
-     WHERE n.nspname = 'public'
-       AND t.relname = ANY (v_tables)
-       AND c.conname LIKE '%plg\_%'
-     ORDER BY t.relname, c.conname
-  LOOP
-    v_new := replace(r.conname, 'plg_', '');
-    CONTINUE WHEN v_new = r.conname OR v_new = '';
-    CONTINUE WHEN EXISTS (
-      SELECT 1 FROM pg_constraint c2
-        JOIN pg_class t2 ON t2.oid = c2.conrelid
-       WHERE t2.relname = r.tbl AND c2.conname = v_new);
-    EXECUTE format('ALTER TABLE public.%I RENAME CONSTRAINT %I TO %I', r.tbl, r.conname, v_new);
-  END LOOP;
-
-  FOR r IN
-    SELECT ic.relname AS idx, t.relname AS tbl
-      FROM pg_index i
-      JOIN pg_class ic    ON ic.oid = i.indexrelid
-      JOIN pg_class t     ON t.oid  = i.indrelid
-      JOIN pg_namespace n ON n.oid  = t.relnamespace
-     WHERE n.nspname = 'public'
-       AND t.relname = ANY (v_tables)
-       AND ic.relname LIKE '%plg\_%'
-     ORDER BY t.relname, ic.relname
-  LOOP
-    v_new := replace(r.idx, 'plg_', '');
-    CONTINUE WHEN v_new = r.idx OR v_new = '';
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_new)) IS NOT NULL;
-    EXECUTE format('ALTER INDEX public.%I RENAME TO %I', r.idx, v_new);
-  END LOOP;
-
-  FOR r IN
-    SELECT g.tgname AS trg, t.relname AS tbl
-      FROM pg_trigger g
-      JOIN pg_class t     ON t.oid = g.tgrelid
-      JOIN pg_namespace n ON n.oid = t.relnamespace
-     WHERE n.nspname = 'public'
-       AND NOT g.tgisinternal
-       AND t.relname = ANY (v_tables)
-       AND g.tgname LIKE '%plg\_%'
-     ORDER BY t.relname, g.tgname
-  LOOP
-    v_new := replace(r.trg, 'plg_', '');
-    CONTINUE WHEN v_new = r.trg OR v_new = '';
-    CONTINUE WHEN EXISTS (
-      SELECT 1 FROM pg_trigger g2
-        JOIN pg_class t2 ON t2.oid = g2.tgrelid
-       WHERE t2.relname = r.tbl AND g2.tgname = v_new);
-    EXECUTE format('ALTER TRIGGER %I ON public.%I RENAME TO %I', r.trg, r.tbl, v_new);
-  END LOOP;
-
-  FOR r IN
-    SELECT p.policyname AS pol, p.tablename AS tbl
-      FROM pg_policies p
-     WHERE p.schemaname = 'public'
-       AND p.tablename = ANY (v_tables)
-       AND p.policyname LIKE '%plg\_%'
-     ORDER BY p.tablename, p.policyname
-  LOOP
-    v_new := replace(r.pol, 'plg_', '');
-    CONTINUE WHEN v_new = r.pol OR v_new = '';
-    CONTINUE WHEN EXISTS (
-      SELECT 1 FROM pg_policies p2
-       WHERE p2.schemaname = 'public' AND p2.tablename = r.tbl AND p2.policyname = v_new);
-    EXECUTE format('ALTER POLICY %I ON public.%I RENAME TO %I', r.pol, r.tbl, v_new);
-  END LOOP;
-END $$;
-
--- ── §3  every function body that still names an old table ───────────────────
--- Done the way 096 pinned search_path: read what the database has, rewrite it,
--- put it back — rather than restating a dozen frozen bodies here and letting
--- the copy rot. `pg_get_functiondef` returns CREATE OR REPLACE, so the OID,
--- owner, ACL and every dependency on the function survive; only the eight table
--- names change, and only where they appear as whole words (`\m…\M`), so
--- plg_prune_sync_runs, uq_plg_connections_account_key and
--- plg_connections_member_read are untouched.
---
--- Extension-owned functions are skipped, and a function whose text does not
--- change is not re-created — so a replay finds nothing to do.
-DO $$
-DECLARE
-  v_names text[] := ARRAY[
-    'analytics_read_models', 'connection_secrets', 'connections', 'connector_schedules',
-    'entity_fields', 'event_log', 'sync_runs', 'sync_schedule'
-  ];
-  r      record;
-  v_def  text;
-  v_name text;
-  i      integer;
-  v_count integer := 0;
-BEGIN
-  FOR r IN
-    SELECT p.oid, p.oid::regprocedure AS sig, pg_get_functiondef(p.oid) AS def
-      FROM pg_proc p
-      JOIN pg_namespace n ON n.oid = p.pronamespace
-     WHERE n.nspname IN ('public', 'app', 'migration')
-       AND p.prokind IN ('f', 'p')
-       AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = p.oid AND d.deptype = 'e')
-     ORDER BY p.oid
-  LOOP
-    v_def := r.def;
-    FOR i IN 1 .. array_length(v_names, 1) LOOP
-      v_name := v_names[i];
-      v_def := regexp_replace(v_def, '\mplg_' || v_name || '\M', v_name, 'g');
-    END LOOP;
-    IF v_def IS DISTINCT FROM r.def THEN
-      EXECUTE v_def;
-      v_count := v_count + 1;
-    END IF;
-  END LOOP;
-  IF v_count > 0 THEN
-    RAISE NOTICE '097: repointed % function(s) at the unprefixed core tables', v_count;
-  END IF;
-END $$;
-
--- ── §4  what the tables say about themselves ────────────────────────────────
--- Guarded per table: the spine bench (packages/db/test/run-migrations.sh)
--- applies a subset of the chain, so not every one of the eight is present in
--- every place this file runs.
-DO $$
-DECLARE
-  v_comments text[][] := ARRAY[
-    ['analytics_read_models',
-     'Allowlist of read models analytics_run() may query. Core (spine 024): a view that is not registered here cannot be reached, however well-formed the card is.'],
-    ['connections',
-     'One tenant''s connection to one external provider, per instance_key. Core (spine 029): the connector framework''s table, used by every connector and owned by none of them.'],
-    ['connection_secrets',
-     'Credential holder for a connection — reachable only through plg_store_connection_secret / plg_read_connection_secret (spine 032). No client role has any privilege on it.'],
-    ['connector_schedules',
-     'How often each connector needs waking, and which edge function + action to wake. Written by a connector''s own migration through plg_register_connector_schedule (spine 033). Granted to no client role: it decides how much of a provider''s quota the whole pool spends.'],
-    ['entity_fields',
-     'The field registry (spine 035): the merchant-defined keys a tenant may write into an entity''s custom_fields, and the rules they are validated against.'],
-    ['event_log',
-     'The domain event log (spine 027) — CORE, not plugin-automations''. plugins/plugin-automations 0002 also CREATEs it as the legacy first writer; the spine owns the definition and plg_emit_event is the only writer.'],
-    ['sync_runs',
-     'One execution of the sync plane, per connection (spine 029). No INSERT grant for authenticated: a history the application can write is not a history.'],
-    ['sync_schedule',
-     'The clock''s bookkeeping: when each connection is next due, what is in flight, how many consecutive failures. Not a history — sync_runs is. Rows are enrolled lazily by plg_sync_tick, with a deterministic offset so a cold start spreads instead of stampeding.']
-  ];
-  i integer;
-BEGIN
-  FOR i IN 1 .. array_length(v_comments, 1) LOOP
-    CONTINUE WHEN to_regclass('public.' || quote_ident(v_comments[i][1])) IS NULL;
-    EXECUTE format('COMMENT ON TABLE public.%I IS %L', v_comments[i][1], v_comments[i][2]);
-  END LOOP;
-END $$;
-
--- ── §5  the access contract, re-asserted on the new names ───────────────────
--- THE SHARP EDGE OF THIS RENAME, and the reason this section exists.
---
--- 007_archetype_grants and 008_grants hand `authenticated` and `service_role`
--- `GRANT ALL ON ALL TABLES IN SCHEMA public`, and `anon` SELECT on all of them.
--- Those are blanket statements over whatever exists when they run. Each of the
--- eight tables then strips itself back in its own file (029/032/033/035) —
--- `REVOKE ALL … FROM anon, authenticated`, then grants back only what the table
--- needs.
---
--- On a REPLAY that pairing breaks: the blanket GRANT lands on the renamed
--- table (`connections`), while the REVOKE in the frozen file lands on the empty
--- `plg_connections` the same replay just re-created — so the tables would come
--- out of a replay with `authenticated` holding INSERT/UPDATE/DELETE on the run
--- history, the credential holder and the scheduler, and `anon` holding SELECT
--- until 009 takes it back. The bench's F3e regression is exactly this, caught.
---
--- So the contract is restated here, on the new names, word for word from the
--- files that own it. Guarded per table: the spine bench applies a subset of the
--- chain, so not all eight exist everywhere this runs.
-DO $$
-DECLARE
-  v_sql text[] := ARRAY[
-    -- 024: the read-model allowlist is readable by any member, written by the migration role.
-    'GRANT SELECT ON public.analytics_read_models TO authenticated',
-    'GRANT ALL    ON public.analytics_read_models TO service_role',
-    -- 029: a member manages its connections and only READS their history.
-    'REVOKE ALL ON public.connections FROM anon, authenticated',
-    'REVOKE ALL ON public.sync_runs   FROM anon, authenticated',
-    'GRANT SELECT, INSERT, UPDATE, DELETE ON public.connections TO authenticated',
-    'GRANT SELECT ON public.sync_runs TO authenticated',
-    -- 032: the credential holder is reachable through its RPCs and nothing else.
-    'REVOKE ALL ON public.connection_secrets FROM PUBLIC',
-    'REVOKE ALL ON public.connection_secrets FROM anon, authenticated',
-    -- 033: neither clock table is tenant data, and that is why both are shut.
-    'REVOKE ALL ON public.connector_schedules FROM PUBLIC',
-    'REVOKE ALL ON public.connector_schedules FROM anon, authenticated',
-    'REVOKE ALL ON public.sync_schedule FROM PUBLIC',
-    'REVOKE ALL ON public.sync_schedule FROM anon, authenticated',
-    -- 035: a member edits its own field definitions, never another tenant's.
-    'REVOKE ALL ON public.entity_fields FROM anon, authenticated',
-    'GRANT SELECT, INSERT, UPDATE, DELETE ON public.entity_fields TO authenticated'
-  ];
-  i     integer;
-  v_tbl text;
-BEGIN
-  FOR i IN 1 .. array_length(v_sql, 1) LOOP
-    v_tbl := substring(v_sql[i] from 'public\.[a-z_]+');
-    CONTINUE WHEN to_regclass(v_tbl) IS NULL;
-    EXECUTE v_sql[i];
-  END LOOP;
-END $$;
-
--- ── §6  the one applied file this rename could not fix forward ──────────────
--- Every consumer of the eight names is repointed either in place (source that
--- is not an applied migration) or by a NEW migration in the owning package
--- (plugin-banking-br 004, @fayz-ai/courses 0011, @fayz-ai/shop 0067) — an
--- applied file is never edited. @fayz-ai/shop 0066_analytics_read_models.sql is
--- the single exception: its `INSERT INTO public.plg_analytics_read_models` is a
--- TOP-LEVEL statement, so on a fresh pool it would error before any later file
--- could repair anything. It is edited, which moves its checksum.
---
--- Forget that one ledger row so the pool re-applies the file (it is idempotent:
--- CREATE OR REPLACE VIEW + INSERT … ON CONFLICT DO UPDATE) instead of stopping
--- on the drift guard forever. `fayz db pool apply` snapshots the ledger before
--- the first file runs, so the apply that carries THIS migration still stops on
--- 0066 and the NEXT one applies it — two passes, both safe, and the operator
--- sees exactly which file moved. The bench's runner reads the ledger per file
--- and converges in one.
-DO $$
-BEGIN
-  IF to_regclass('public._migrations') IS NOT NULL THEN
-    DELETE FROM public._migrations WHERE file_name = '0066_analytics_read_models.sql';
-  END IF;
-END $$;