@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/147_every_archetype_has_a_kind_registry.sql

@@ -1,388 +0,0 @@
--- ============================================================================
--- 147_every_archetype_has_a_kind_registry.sql — a species has a declared owner,
--- and the database is what says so.
---
--- Phase 1, ADR 0017 + the round-3 decision. The Venda has had a registry since
--- 090: `public.order_kinds`, a natural-key text PK with the owning plugin and
--- the lifecycle it allows. Every other archetype had `kind text NOT NULL` and
--- nothing else — any value entered, and nobody could say whose it was. With
--- closed and third-party plugins that stops being a hypothesis: two plugins
--- reach for `reservation`, both write, and the row belongs to no lifecycle.
---
--- WHY TEXT AND NOT A SURROGATE ID. The species is written literally by plugin
--- code (`kind = 'appointment'`), read by RLS predicates, carried in the plugin
--- manifest, the API, the event log and the support dump. An integer id would
--- force a lookup on every insert and a join on every read, and would make a log
--- line unreadable, in exchange for nothing: the cardinality is dozens, and the
--- name is a public contract identifier that cannot be renamed freely either way.
--- The format CHECK is what makes it an identifier rather than free user text.
---
--- WHY A REAL FK AND NOT A TRIGGER. 090 guarded `orders.kind` with a BEFORE
--- trigger because the registry is seeded by plugin migrations that run after the
--- core, and legacy rows could arrive before the row existed. That reasoning is
--- retired: V1 rows that do not fit go to `migration.quarantine` — a human
--- decision — and never a weakened constraint. A FK is cheaper than a trigger,
--- it is declarative, and on uninstall it refuses to drop a species while rows
--- still use it, which is exactly the question we want asked out loud.
---
--- WHAT `status` IS FOR. Live pools already hold values written before any
--- registry existed. Refusing them would break writing; inventing an owner for
--- them would be a lie. They are ADOPTED: registered so the FK can be created and
--- the data keeps working, marked so the census can list what still has no owner.
--- `declared` is a plugin saying "mine"; `adopted` is the database saying "this
--- was here and nobody has claimed it".
---
--- PEOPLE NEEDS TWO REGISTRIES, and that is not duplication. `person_roles.role`
--- is the canonical hat (customer, professional, employee, contact, supplier,
--- lead) and `people.kind` is the denormalised primary-role mirror, whose
--- vocabulary is deliberately WIDER: 080's `person_kind_to_role` maps 'staff' to
--- employee and 'vendor' to supplier, and 110 added 'client' as a synonym of
--- customer. So the mirror gets its own registry carrying the mapping AS DATA —
--- which retires the hard-coded CASE and lets a vertical register 'patient'
--- instead of resolving to no role at all (the shape of #204).
---
--- Idempotent and replay-safe: every object guarded, every backfill a no-op on
--- a second pass, every FK created only when absent.
--- ============================================================================
-
--- ─────────────────────────────────────────────────────────────────────────
--- §1  The registry shape, applied five times
---
--- One table per archetype rather than one table with an (archetype, kind) key:
--- a composite key would force every archetype to carry a constant discriminator
--- column just so the FK could reference it. Five small tables of identical shape
--- keep the FK a one-liner and keep each registry readable on its own.
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-DECLARE
-  v_table text;
-BEGIN
-  FOREACH v_table IN ARRAY ARRAY['person_role_kinds', 'person_kinds', 'category_kinds', 'appointment_kinds', 'schedule_kinds']
-  LOOP
-    EXECUTE format($ddl$
-      CREATE TABLE IF NOT EXISTS public.%I (
-        kind        text PRIMARY KEY,
-        plugin      text NOT NULL,
-        description text,
-        statuses    text[],
-        transitions jsonb,
-        status      text NOT NULL DEFAULT 'declared',
-        created_at  timestamptz NOT NULL DEFAULT now(),
-        updated_at  timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT %I CHECK (kind ~ '^[a-z][a-z0-9_]*$'),
-        CONSTRAINT %I CHECK (status IN ('declared', 'adopted'))
-      )$ddl$, v_table, v_table || '_format', v_table || '_status');
-
-    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', v_table);
-    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', v_table || '_select', v_table);
-    EXECUTE format($pol$
-      CREATE POLICY %I ON public.%I FOR SELECT TO anon, authenticated, service_role USING (true)
-    $pol$, v_table || '_select', v_table);
-    EXECUTE format('GRANT SELECT ON public.%I TO anon, authenticated, service_role', v_table);
-    EXECUTE format('GRANT ALL ON public.%I TO service_role', v_table);
-    EXECUTE format('REVOKE INSERT, UPDATE, DELETE ON public.%I FROM anon, authenticated', v_table);
-
-    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', v_table || '_updated_at', v_table);
-    EXECUTE format($trg$
-      CREATE TRIGGER %I BEFORE UPDATE ON public.%I
-        FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()
-    $trg$, v_table || '_updated_at', v_table);
-  END LOOP;
-END $$;
-
--- `order_kinds` predates this file and already carries kind/plugin/description/
--- statuses/transitions; it only lacks the status column, so the census can speak
--- about all six registries in one sentence.
-ALTER TABLE public.order_kinds ADD COLUMN IF NOT EXISTS status text NOT NULL DEFAULT 'declared';
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'order_kinds_status') THEN
-    ALTER TABLE public.order_kinds ADD CONSTRAINT order_kinds_status CHECK (status IN ('declared', 'adopted'));
-  END IF;
-END $$;
-
--- The mirror registry carries the map that 080 hard-coded in a CASE.
-ALTER TABLE public.person_kinds ADD COLUMN IF NOT EXISTS maps_to_role text;
-
-COMMENT ON TABLE public.person_role_kinds IS
-  'The species registry of the Person hat: which roles exist and who declared them (147). person_roles.role has a FK to this.';
-COMMENT ON TABLE public.person_kinds IS
-  'The species registry of people.kind — the denormalised primary-role mirror, whose vocabulary is wider than the roles themselves. maps_to_role is 080''s CASE turned into data (147).';
-COMMENT ON TABLE public.category_kinds IS
-  'The species registry of the Category archetype (147).';
-COMMENT ON TABLE public.appointment_kinds IS
-  'The species registry of the Compromisso archetype: appointment, table reservation, shift, class — each declared by the plugin that owns its lifecycle (147).';
-COMMENT ON TABLE public.schedule_kinds IS
-  'The species registry of the Escala archetype (147).';
-COMMENT ON COLUMN public.person_kinds.maps_to_role IS
-  'Which canonical role this mirror value resolves to. NULL means the vertical registered a kind with no role equivalent — legible, unlike the NULL that person_kind_to_role used to return for it.';
-
--- ─────────────────────────────────────────────────────────────────────────
--- §2  register_kind — one entry point, dispatching by archetype
---
--- Same semantics as 090's register_order_kind, which stays as a thin alias so
--- no existing caller changes: idempotent upsert; NULL statuses AND NULL
--- transitions on an existing row leave the lifecycle untouched, so a
--- re-register with defaults never loosens what a plugin tightened.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE OR REPLACE FUNCTION public.kind_registry_table(p_archetype text)
-RETURNS text
-LANGUAGE sql IMMUTABLE PARALLEL SAFE
-AS $$
-  SELECT CASE p_archetype
-    WHEN 'order'       THEN 'order_kinds'
-    WHEN 'person_role' THEN 'person_role_kinds'
-    WHEN 'person'      THEN 'person_kinds'
-    WHEN 'category'    THEN 'category_kinds'
-    WHEN 'appointment' THEN 'appointment_kinds'
-    WHEN 'schedule'    THEN 'schedule_kinds'
-  END
-$$;
-
-COMMENT ON FUNCTION public.kind_registry_table(text) IS
-  'Which registry holds the species of this archetype. NULL for an archetype with no registry — register_kind turns that into an error rather than a silent no-op (147).';
-
-CREATE OR REPLACE FUNCTION public.register_kind(
-  p_archetype   text,
-  p_kind        text,
-  p_plugin      text,
-  p_statuses    text[] DEFAULT NULL,
-  p_transitions jsonb  DEFAULT NULL,
-  p_description text   DEFAULT NULL
-) RETURNS void
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_table text := public.kind_registry_table(p_archetype);
-BEGIN
-  IF v_table IS NULL THEN
-    RAISE EXCEPTION 'register_kind: % is not an archetype with a species registry', p_archetype
-      USING ERRCODE = '22023',
-            HINT = 'The archetypes with registries are order, person_role, person, category, appointment, schedule.';
-  END IF;
-
-  IF v_table = 'order_kinds' THEN
-    PERFORM public.register_order_kind(p_kind, p_plugin, p_statuses, p_transitions, p_description);
-    RETURN;
-  END IF;
-
-  EXECUTE format($sql$
-    INSERT INTO public.%I (kind, plugin, description, statuses, transitions, status)
-    VALUES ($1, $2, $3, $4, $5, 'declared')
-    ON CONFLICT (kind) DO UPDATE
-      SET plugin      = EXCLUDED.plugin,
-          description = coalesce(EXCLUDED.description, public.%I.description),
-          statuses    = CASE WHEN $4 IS NULL AND $5 IS NULL THEN public.%I.statuses    ELSE EXCLUDED.statuses    END,
-          transitions = CASE WHEN $4 IS NULL AND $5 IS NULL THEN public.%I.transitions ELSE EXCLUDED.transitions END,
-          status      = 'declared'
-  $sql$, v_table, v_table, v_table, v_table)
-  USING p_kind, p_plugin, p_description, p_statuses, p_transitions;
-END $$;
-
-COMMENT ON FUNCTION public.register_kind(text, text, text, text[], jsonb, text) IS
-  'A plugin declares a species as a ROW, never by DDL (147). Re-registering an adopted species is how it stops being ownerless: status returns to declared.';
-
-REVOKE ALL ON FUNCTION public.register_kind(text, text, text, text[], jsonb, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.register_kind(text, text, text, text[], jsonb, text) TO service_role;
-
--- Registering a Person mirror value also states which role it resolves to.
-CREATE OR REPLACE FUNCTION public.register_person_kind(
-  p_kind        text,
-  p_plugin      text,
-  p_maps_to_role text DEFAULT NULL,
-  p_description text   DEFAULT NULL
-) RETURNS void
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-BEGIN
-  PERFORM public.register_kind('person', p_kind, p_plugin, NULL, NULL, p_description);
-  UPDATE public.person_kinds SET maps_to_role = p_maps_to_role WHERE kind = p_kind;
-END $$;
-
-REVOKE ALL ON FUNCTION public.register_person_kind(text, text, text, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.register_person_kind(text, text, text, text) TO service_role;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §3  What the base declares
---
--- The base owns the vocabulary that exists because the archetype exists. A
--- plugin's own species is declared in the plugin's own migration — that is the
--- rule this file is here to enforce, so nothing plugin-shaped is seeded here.
--- ─────────────────────────────────────────────────────────────────────────
-
-SELECT public.register_kind('person_role', r.role, 'base', NULL, NULL, r.note)
-FROM (VALUES
-  ('customer',     'Someone the tenant sells to'),
-  ('professional', 'Someone who performs services and appears on the calendar'),
-  ('employee',     'Someone on the payroll'),
-  ('contact',      'Someone related to the tenant without buying or working'),
-  ('supplier',     'Someone the tenant buys from'),
-  ('lead',         'Someone not yet a customer')
-) AS r(role, note);
-
--- The mirror vocabulary, carrying 080's CASE and 110's synonym as rows.
-SELECT public.register_person_kind(k.kind, 'base', k.role, k.note)
-FROM (VALUES
-  ('customer',     'customer',     'The mirror of the customer hat'),
-  ('client',       'customer',     'Synonym of customer, kept because shipped plugin versions wrote it (110)'),
-  ('staff',        'employee',     'Legacy spelling of the employee hat'),
-  ('employee',     'employee',     'The mirror of the employee hat'),
-  ('professional', 'professional', 'The mirror of the professional hat'),
-  ('lead',         'lead',         'The mirror of the lead hat'),
-  ('supplier',     'supplier',     'The mirror of the supplier hat'),
-  ('vendor',       'supplier',     'Legacy spelling of the supplier hat'),
-  ('contact',      'contact',      'The mirror of the contact hat')
-) AS k(kind, role, note);
-
--- The Category taxonomy the base itself ships. `service` and `good` mirror the
--- catalog discriminator; a plugin's own taxonomy (the shop's `shop`, the menu's
--- `menu_category`) is declared in that plugin's migration, which is the rule
--- this file exists to make enforceable.
-SELECT public.register_kind('category', c.kind, 'base', NULL, NULL, c.note)
-FROM (VALUES
-  ('service', 'Groups the services a tenant sells'),
-  ('good',    'Groups the goods a tenant sells'),
-  ('product', 'The V1 vocabulary the extractor writes by default (102) — a synonym of good, kept because the data says it')
-) AS c(kind, note);
-
--- NOT products.kind. That column is a deliberate closed binary (good|service,
--- 085's CHECK) — the archetype's own discriminator, with `subkind` and
--- `service_kind` as the open extension points. A registry there would offer an
--- openness the catalog contract does not have.
-
--- person_kind_to_role stops being a CASE and becomes a lookup. Same signature,
--- same NULL-for-unknown contract, so every existing caller is unaffected —
--- except that a vertical can now teach it a value by registering one.
-CREATE OR REPLACE FUNCTION public.person_kind_to_role(p_kind text)
-RETURNS text LANGUAGE sql STABLE PARALLEL SAFE
-SET search_path = ''
-AS $$
-  SELECT k.maps_to_role FROM public.person_kinds k WHERE k.kind = p_kind
-$$;
-
-COMMENT ON FUNCTION public.person_kind_to_role(text) IS
-  'Which role a people.kind value resolves to. Since 147 this reads public.person_kinds instead of a hard-coded CASE — registering a kind is how a vertical teaches it (was: NULL, the shape of #204).';
-
--- ─────────────────────────────────────────────────────────────────────────
--- §4  Adoption — what is already in the data, made legible
---
--- Every distinct value present in a live pool and absent from its registry is
--- registered as `adopted`, owner unknown. Nothing is refused and nothing is
--- invented: the census in §6 is what turns this into work.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE OR REPLACE FUNCTION public.adopt_existing_kinds(p_archetype text, p_table text, p_column text)
-RETURNS integer
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_registry text := public.kind_registry_table(p_archetype);
-  v_count integer := 0;
-BEGIN
-  IF v_registry IS NULL OR to_regclass('public.' || quote_ident(p_table)) IS NULL THEN
-    RETURN 0;
-  END IF;
-  EXECUTE format($sql$
-    INSERT INTO public.%I (kind, plugin, description, status)
-    SELECT DISTINCT t.%I, 'unattributed',
-           'Present in the data before any registry existed; adopted by 147 so the FK could be created. Needs an owner.',
-           'adopted'
-      FROM public.%I t
-     WHERE t.%I IS NOT NULL
-       AND t.%I ~ '^[a-z][a-z0-9_]*$'
-    ON CONFLICT (kind) DO NOTHING
-  $sql$, v_registry, p_column, p_table, p_column, p_column);
-  GET DIAGNOSTICS v_count = ROW_COUNT;
-  RETURN v_count;
-END $$;
-
-COMMENT ON FUNCTION public.adopt_existing_kinds(text, text, text) IS
-  'Registers, as adopted, every species already present in the data and missing from its registry — so the FK in §5 can be added without refusing a live write or inventing an owner (147).';
-
-REVOKE ALL ON FUNCTION public.adopt_existing_kinds(text, text, text) FROM public, anon, authenticated;
-
-SELECT public.adopt_existing_kinds('person_role', 'person_roles',  'role');
-SELECT public.adopt_existing_kinds('person',      'people',        'kind');
-SELECT public.adopt_existing_kinds('category',    'categories',    'kind');
-SELECT public.adopt_existing_kinds('appointment', 'appointments',  'kind');
-SELECT public.adopt_existing_kinds('schedule',    'schedules',     'kind');
-SELECT public.adopt_existing_kinds('order',       'orders',        'kind');
-
--- A value that does not even look like an identifier cannot be adopted, and must
--- not be silently dropped either. It is a data question, and the machine that
--- exists for data questions is the quarantine.
-DO $$
-DECLARE
-  v_pair record;
-  v_bad integer;
-BEGIN
-  IF to_regclass('migration.quarantine') IS NULL THEN
-    RETURN;
-  END IF;
-  FOR v_pair IN SELECT * FROM (VALUES
-    ('person_roles', 'role'), ('people', 'kind'), ('categories', 'kind'),
-    ('appointments', 'kind'), ('schedules', 'kind'), ('orders', 'kind')
-  ) AS p(tbl, col)
-  LOOP
-    IF to_regclass('public.' || quote_ident(v_pair.tbl)) IS NULL THEN CONTINUE; END IF;
-    EXECUTE format('SELECT count(*)::int FROM public.%I WHERE %I IS NOT NULL AND %I !~ ''^[a-z][a-z0-9_]*$''',
-                   v_pair.tbl, v_pair.col, v_pair.col) INTO v_bad;
-    IF v_bad > 0 THEN
-      RAISE EXCEPTION '147: %.% holds % value(s) that are not identifiers and cannot be registered', v_pair.tbl, v_pair.col, v_bad
-        USING HINT = 'Quarantine or correct those rows first — a species outside the identifier format has no owner and no lifecycle.';
-    END IF;
-  END LOOP;
-END $$;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §5  The FKs — the whole point of the file
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-DECLARE
-  v_fk record;
-BEGIN
-  FOR v_fk IN SELECT * FROM (VALUES
-    ('person_roles', 'role', 'person_role_kinds', 'person_roles_role_registered'),
-    ('people',       'kind', 'person_kinds',      'people_kind_registered'),
-    ('categories',   'kind', 'category_kinds',    'categories_kind_registered'),
-    ('appointments', 'kind', 'appointment_kinds', 'appointments_kind_registered'),
-    ('schedules',    'kind', 'schedule_kinds',    'schedules_kind_registered'),
-    ('orders',       'kind', 'order_kinds',       'orders_kind_registered')
-  ) AS f(tbl, col, registry, conname)
-  LOOP
-    IF to_regclass('public.' || quote_ident(v_fk.tbl)) IS NULL THEN CONTINUE; END IF;
-    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = v_fk.conname) THEN
-      EXECUTE format('ALTER TABLE public.%I ADD CONSTRAINT %I FOREIGN KEY (%I) REFERENCES public.%I(kind)',
-                     v_fk.tbl, v_fk.conname, v_fk.col, v_fk.registry);
-    END IF;
-  END LOOP;
-END $$;
-
--- person_roles carried the vocabulary as a CHECK. The FK supersedes it: a CHECK
--- can only be widened by a migration, which is precisely what made a vertical's
--- 'patient' impossible to express.
-ALTER TABLE public.person_roles DROP CONSTRAINT IF EXISTS person_roles_role_check;
-
-COMMENT ON CONSTRAINT people_kind_registered ON public.people IS
-  'A species with no declared owner cannot be written (147). Registering one is a row in public.person_kinds, never DDL.';
-
--- ─────────────────────────────────────────────────────────────────────────
--- §6  The census — one view over all six registries
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE OR REPLACE VIEW public.v_archetype_kinds
-WITH (security_invoker = true) AS
-  SELECT 'order'::text AS archetype, kind, plugin, description, statuses, transitions, status FROM public.order_kinds
-  UNION ALL SELECT 'person_role', kind, plugin, description, statuses, transitions, status FROM public.person_role_kinds
-  UNION ALL SELECT 'person',      kind, plugin, description, statuses, transitions, status FROM public.person_kinds
-  UNION ALL SELECT 'category',    kind, plugin, description, statuses, transitions, status FROM public.category_kinds
-  UNION ALL SELECT 'appointment', kind, plugin, description, statuses, transitions, status FROM public.appointment_kinds
-  UNION ALL SELECT 'schedule',    kind, plugin, description, statuses, transitions, status FROM public.schedule_kinds;
-
-COMMENT ON VIEW public.v_archetype_kinds IS
-  'Every declared species of every archetype, with its owner (147). status = adopted is the backlog: a species the data already had and no plugin has claimed.';
-
-GRANT SELECT ON public.v_archetype_kinds TO anon, authenticated, service_role;

package/migrations/148_the_legacy_archetype_stops_being_writable.sql

@@ -1,154 +0,0 @@
--- ============================================================================
--- 148_the_legacy_archetype_stops_being_writable.sql — one book, and the tables
--- that carry a base name get a declared owner (#285).
---
--- Three cleanups the decisions already settled, in one file because they are the
--- same shape: something in `public` has no owner, or two things answer the same
--- question.
---
--- §1  public.transactions — 065 wrote it down in the file itself: "legacy
---     generic archetype; O2C's ledger supersedes it", and 101 repeats it in the
---     allowlist: "superseded by financial_movements". Two books for one fact,
---     and the newer one is the canonical one. This file does not DROP it: a
---     live pool holds rows nobody has read in months, and dropping is a decision
---     with no undo. It does the thing that makes the second book stop being a
---     book — REVOKE the writes, leaving reads alone — and records the retirement
---     so the drop is a later, deliberate step with the count in hand.
---
--- §2  sequences — created by the base (a numbering service every domain needs)
---     AND by plugin-financial's 027. Two creators, one name, and whichever ran
---     last owned it. The base is the owner; the plugin's copy is guarded to a
---     no-op by the IF NOT EXISTS it already carries, so what is left is to say
---     so out loud and let the census enforce it.
---
--- §3  shipping_zones / shipping_settings — created by packages/shop's 0021,
---     living in `public` with no prefix, which reads as base and is not. Same
---     class as documents (forms) and sequences (financial). Renaming a table
---     that live storefront code reads is a synchronised deploy, and 141 already
---     built the mechanism for exactly this: the object moves and the old name
---     keeps answering, with the table's grants copied onto the alias so the
---     callers keep the access they have today. That is what happens here —
---     WRITES INCLUDED, because the shop writes both of these through the old
---     name and a read-only bridge is not a bridge for a writer.
---
--- Idempotent and replay-safe.
--- ============================================================================
-
--- ─────────────────────────────────────────────────────────────────────────
--- §1  The legacy archetype becomes read-only
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-BEGIN
-  IF to_regclass('public.transactions') IS NULL THEN
-    RETURN;
-  END IF;
-
-  -- Reads keep working: dashboards, the migration ledger and any support query
-  -- can still see what is there. Writes stop, which is what makes the ledger the
-  -- only book being kept from here on.
-  REVOKE INSERT, UPDATE, DELETE ON public.transactions FROM anon, authenticated;
-
-  EXECUTE $c$ COMMENT ON TABLE public.transactions IS
-    'RETIRED (148). The legacy generic archetype the two-leg ledger superseded — plg_financial_movements is the book. Reads left in place for history; writes revoked. Drop is a separate, deliberate step once every pool reports zero rows unaccounted for in the ledger.' $c$;
-END $$;
-
--- The drop gate — "which rows here is the ledger not accounting for?" — is as
--- much a question about a plugin's table as about this one, so it lives with the
--- plugin that keeps the book: plugin-financial 034.
-
--- ─────────────────────────────────────────────────────────────────────────
--- §2  sequences belongs to the base, and the census can prove it
---
--- The prefix rule (ADR 0011) says `plg_` means "owned by plugin X". The inverse
--- has had no register: an unprefixed table in `public` is base-owned by
--- convention only. This is that register — the base declares what is its, and
--- check-schema-ownership reads it.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE TABLE IF NOT EXISTS app.base_owned_tables (
-  table_name text PRIMARY KEY,
-  note       text,
-  created_at timestamptz NOT NULL DEFAULT now()
-);
-
-COMMENT ON TABLE app.base_owned_tables IS
-  'Unprefixed tables in public that the BASE owns (148). A plugin creating a table whose name is in here is the violation the ownership census reports — the prefix rule only ever answered the other direction.';
-
-ALTER TABLE app.base_owned_tables ENABLE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS base_owned_tables_read ON app.base_owned_tables;
-CREATE POLICY base_owned_tables_read ON app.base_owned_tables FOR SELECT TO authenticated, service_role USING (true);
-GRANT SELECT ON app.base_owned_tables TO authenticated, service_role;
-
-INSERT INTO app.base_owned_tables (table_name, note) VALUES
-  ('sequences',            'Numbering for every domain. plugin-financial 027 also creates it, guarded — the base is the owner.'),
-  ('people',               'The Person archetype.'),
-  ('person_roles',         'The hats a Person wears.'),
-  ('products',             'The Item de catálogo archetype.'),
-  ('services',             'The service half of the catalog.'),
-  ('product_variants',     'The shape of what is sold — the archetype, not the shop copy (ADR 0024).'),
-  ('categories',           'The Category archetype.'),
-  ('orders',               'The Venda archetype.'),
-  ('order_items',          'The lines of a Venda.'),
-  ('appointments',         'The Compromisso archetype.'),
-  ('appointment_items',    'The lines of a Compromisso.'),
-  ('schedules',            'The Escala archetype.'),
-  ('addresses',            'Where a Person, a unit or a tenant is.'),
-  ('company_legal_entities','The Empresa.'),
-  ('tenants',              'The tenant itself.'),
-  ('invitations',          'An invite to become a member.'),
-  ('audit_logs',           'The append-only audit trail.'),
-  ('holidays',             'The calendar the tenant does not work.'),
-  ('access_grants',        'Delegated access (ADR 0011).'),
-  ('access_sessions',      'The session a grant issues.')
-ON CONFLICT (table_name) DO UPDATE SET note = EXCLUDED.note;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §3  Shipping moves under the shop's prefix, and the old name keeps answering
---
--- 141's mechanism: rename, then leave a view with the old name so no deploy has
--- to be synchronised. Guarded on every side — a pool without the shop installed
--- has neither name and skips the whole block.
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-DECLARE
-  v_pair record;
-  g      record;
-BEGIN
-  FOR v_pair IN SELECT * FROM (VALUES
-    ('shipping_zones',    'plg_shop_shipping_zones'),
-    ('shipping_settings', 'plg_shop_shipping_settings')
-  ) AS p(old_name, new_name)
-  LOOP
-    IF to_regclass('public.' || quote_ident(v_pair.old_name)) IS NOT NULL
-       AND to_regclass('public.' || quote_ident(v_pair.new_name)) IS NULL THEN
-      -- Only a TABLE moves; if the old name is already the compat view this
-      -- migration wrote on a previous pass, there is nothing to do.
-      IF EXISTS (SELECT 1 FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
-                  WHERE n.nspname = 'public' AND c.relname = v_pair.old_name AND c.relkind = 'r') THEN
-        EXECUTE format('ALTER TABLE public.%I RENAME TO %I', v_pair.old_name, v_pair.new_name);
-        EXECUTE format('CREATE OR REPLACE VIEW public.%I WITH (security_invoker = true) AS SELECT * FROM public.%I',
-                       v_pair.old_name, v_pair.new_name);
-        -- The alias is exactly as reachable as what it points at — 141's rule,
-        -- and the reason this is a loop and not a hardcoded GRANT SELECT.
-        -- Shipping zones and settings are WRITTEN through the old name by the
-        -- published SDK (`packages/shop/src/data/tables.ts` still says
-        -- 'shipping_zones'), so a read-only alias does not make the rename
-        -- unsynchronised — it moves the breakage from "the table is gone" to
-        -- "permission denied for view", on the merchant's delivery screen.
-        FOR g IN
-          SELECT DISTINCT grantee, privilege_type
-            FROM information_schema.role_table_grants
-           WHERE table_schema = 'public'
-             AND table_name = v_pair.new_name
-             AND grantee IN ('anon', 'authenticated', 'service_role')
-        LOOP
-          EXECUTE format('GRANT %s ON public.%I TO %I', g.privilege_type, v_pair.old_name, g.grantee);
-        END LOOP;
-        EXECUTE format($c$ COMMENT ON VIEW public.%I IS 'Compat name for public.%I (148, mechanism from 141). The table carries the shop prefix now; this view is what lets the rename not be a synchronised deploy.' $c$,
-                       v_pair.old_name, v_pair.new_name);
-      END IF;
-    END IF;
-  END LOOP;
-END $$;