@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/156_the_service_door_has_a_server_side.sql

@@ -1,335 +0,0 @@
--- ---------------------------------------------------------------------------
--- 156_the_service_door_has_a_server_side.sql — the half of #278 that 153 could
--- not carry: WHERE a service lives, and how it is called with no browser.
---
--- 153 built the decision layer — which services exist, who may call one, what
--- happens when it is down, and what was called. What it deliberately did not
--- build is the leg that leaves the cluster, because a migration that opened a
--- socket would be the wrong kind of clever. That leg is an edge function
--- (`functions/service-router`), and this file is what the function reads.
---
--- ── Why the endpoint is not a column on app.services ────────────────────────
--- `services_read` grants SELECT on app.services to every authenticated user,
--- and that is correct: a screen needs the manual fallback and the entitlement
--- to render an honest refusal. An upstream URL is a different kind of fact —
--- internal topology, sometimes carrying a path that names a vendor. It goes in
--- its own table that `authenticated` cannot read at all, so widening the one
--- does not widen the other.
---
--- ── Why the credential is a NAME and not a value ────────────────────────────
--- app.service_endpoints stores `auth_env` — the name of the environment
--- variable the router reads — never the secret. A secret in a table is a secret
--- in every backup, every replica and every `pg_dump` somebody mails themselves.
--- The cluster carries the credential in its function environment; the database
--- carries only the instruction for finding it.
---
--- ── Why there is a second authorize ─────────────────────────────────────────
--- `service_authorize` answers for auth.uid() in the current tenant, which is
--- exactly right for a click. It is useless at 2am: the event consumer (#277)
--- reacts to a fact with no session, no JWT and no user, and 153's function
--- would answer `no_tenant` forever. `service_authorize_for` takes the tenant
--- explicitly, is service_role-only, and skips the permission check because
--- there is no person to have permissions — the entitlement check stays, because
--- the tenant's contract is a property of the tenant, not of who is looking.
--- ---------------------------------------------------------------------------
-
--- ─────────────────────────────────────────────────────────────────────────
--- §1  Where a service lives
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE TABLE IF NOT EXISTS app.service_endpoints (
-  service    text PRIMARY KEY REFERENCES app.services(name) ON DELETE CASCADE,
-  -- Absolute https URL. http is allowed only for loopback, so a dev machine
-  -- works and a production typo does not silently downgrade the transport.
-  url        text NOT NULL CHECK (
-               url ~ '^https://' OR url ~ '^http://(localhost|127\.0\.0\.1)(:[0-9]+)?(/|$)'
-             ),
-  -- The NAME of the env var holding the credential. Never the credential.
-  auth_env   text CHECK (auth_env IS NULL OR auth_env ~ '^[A-Z][A-Z0-9_]*$'),
-  -- How the credential is presented: bearer (Authorization: Bearer …) or a
-  -- header the vendor names.
-  auth_style text NOT NULL DEFAULT 'bearer' CHECK (auth_style IN ('bearer', 'header', 'none')),
-  auth_header text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-
-COMMENT ON TABLE app.service_endpoints IS
-  'Where each service actually lives, and the NAME of the env var holding the credential to reach it (156). Readable by service_role only: app.services is public to a signed-in user because a screen needs the fallback text, and internal topology is not the same fact.';
-COMMENT ON COLUMN app.service_endpoints.auth_env IS
-  'The name of an environment variable, never a secret. A secret in a table is a secret in every backup.';
-
-ALTER TABLE app.service_endpoints ENABLE ROW LEVEL SECURITY;
--- No policy for `authenticated` on purpose: the table is service_role's.
-REVOKE ALL ON app.service_endpoints FROM anon, authenticated;
-GRANT ALL ON app.service_endpoints TO service_role;
-
-DROP TRIGGER IF EXISTS service_endpoints_updated_at ON app.service_endpoints;
-CREATE TRIGGER service_endpoints_updated_at BEFORE UPDATE ON app.service_endpoints
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
-CREATE OR REPLACE FUNCTION public.register_service_endpoint(
-  p_service     text,
-  p_url         text,
-  p_auth_env    text DEFAULT NULL,
-  p_auth_style  text DEFAULT 'bearer',
-  p_auth_header text DEFAULT NULL
-) RETURNS void
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-BEGIN
-  IF p_auth_style = 'header' AND coalesce(btrim(p_auth_header), '') = '' THEN
-    RAISE EXCEPTION 'register_service_endpoint: auth_style=header needs auth_header'
-      USING ERRCODE = '22023';
-  END IF;
-  INSERT INTO app.service_endpoints (service, url, auth_env, auth_style, auth_header)
-  VALUES (p_service, p_url, p_auth_env, p_auth_style, p_auth_header)
-  ON CONFLICT (service) DO UPDATE
-    SET url = EXCLUDED.url, auth_env = EXCLUDED.auth_env,
-        auth_style = EXCLUDED.auth_style, auth_header = EXCLUDED.auth_header;
-END $$;
-
-REVOKE ALL ON FUNCTION public.register_service_endpoint(text, text, text, text, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.register_service_endpoint(text, text, text, text, text) TO service_role;
-
--- What the router reads, in one call, after it has authorized. Returns NULL
--- rather than raising when a service has no endpoint: "registered but not
--- reachable yet" is a real and temporary state, and the router turns it into
--- the same honest refusal as any other unreachable service.
-CREATE OR REPLACE FUNCTION public.service_endpoint(p_service text)
-RETURNS jsonb
-LANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''
-AS $$
-  SELECT jsonb_build_object(
-           'service', e.service, 'url', e.url, 'auth_env', e.auth_env,
-           'auth_style', e.auth_style, 'auth_header', e.auth_header,
-           'timeout_ms', s.timeout_ms)
-    FROM app.service_endpoints e
-    JOIN app.services s ON s.name = e.service
-   WHERE e.service = p_service AND s.is_active;
-$$;
-
-REVOKE ALL ON FUNCTION public.service_endpoint(text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.service_endpoint(text) TO service_role;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §2  Authorizing with no person in the room
--- ─────────────────────────────────────────────────────────────────────────
-
--- 150's `tenant_plugin_active` reads app.current_tenant_id(), which is a JWT
--- claim. A background reaction has no JWT, so it needs the same question asked
--- of an explicit tenant. Same predicate, one argument more — not a second
--- source of truth for what a tenant has.
-CREATE OR REPLACE FUNCTION public.tenant_plugin_active_for(p_tenant uuid, p_plugin text, p_facet text DEFAULT '')
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''
-AS $$
-  SELECT EXISTS (
-    SELECT 1 FROM app.tenant_plugins t
-     WHERE t.tenant_id = p_tenant
-       AND t.plugin_id = p_plugin
-       AND t.facet = coalesce(p_facet, '')
-       AND t.status = 'active'
-       AND (t.expires_at IS NULL OR t.expires_at > now())
-  )
-$$;
-
-COMMENT ON FUNCTION public.tenant_plugin_active_for(uuid, text, text) IS
-  'tenant_plugin_active for an explicit tenant (156) — the same predicate, for a caller with no session. service_role only: a signed-in user asks about their own tenant and already has the other one.';
-
-REVOKE ALL ON FUNCTION public.tenant_plugin_active_for(uuid, text, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.tenant_plugin_active_for(uuid, text, text) TO service_role;
-
-
-CREATE OR REPLACE FUNCTION public.service_authorize_for(p_name text, p_tenant uuid)
-RETURNS jsonb
-LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_service app.services%ROWTYPE;
-BEGIN
-  IF p_tenant IS NULL THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'no_tenant');
-  END IF;
-
-  SELECT * INTO v_service FROM app.services WHERE name = p_name;
-  IF NOT FOUND OR NOT v_service.is_active THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'unknown_service');
-  END IF;
-
-  -- No permission check: there is no person. A background reaction acts for the
-  -- tenant, not for a user, and inventing a user to check would be a lie the
-  -- audit trail then repeats.
-  IF v_service.entitlement IS NOT NULL
-     AND NOT public.tenant_plugin_active_for(p_tenant, v_service.plugin, v_service.entitlement) THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'not_contracted',
-                              'entitlement', v_service.entitlement,
-                              'plugin', v_service.plugin,
-                              'manual_fallback', v_service.manual_fallback);
-  END IF;
-
-  RETURN jsonb_build_object('allowed', true, 'service', v_service.name, 'tenant_id', p_tenant,
-                            'timeout_ms', v_service.timeout_ms,
-                            'manual_fallback', v_service.manual_fallback,
-                            'actor', 'system');
-END $$;
-
-COMMENT ON FUNCTION public.service_authorize_for(text, uuid) IS
-  'service_authorize for a caller with no session (156): the event consumer reacting to a fact at 2am. Same entitlement rule, no permission rule — there is no person to have one. service_role only.';
-
-REVOKE ALL ON FUNCTION public.service_authorize_for(text, uuid) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.service_authorize_for(text, uuid) TO service_role;
-
--- The same for the history: a system call still has to be findable when
--- somebody asks why the stock did not move.
-CREATE OR REPLACE FUNCTION public.service_call_record_for(
-  p_service text, p_tenant uuid, p_status text,
-  p_reason text DEFAULT NULL, p_duration_ms integer DEFAULT NULL
-) RETURNS uuid
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_id uuid;
-BEGIN
-  INSERT INTO app.service_calls (tenant_id, service, caller, status, reason, duration_ms)
-  VALUES (p_tenant, p_service, NULL, p_status, p_reason, p_duration_ms)
-  RETURNING id INTO v_id;
-  RETURN v_id;
-END $$;
-
-COMMENT ON FUNCTION public.service_call_record_for(text, uuid, text, text, integer) IS
-  'Records a service call made with no session (156). caller is NULL — deliberately: the row says "the system did this", which is true, instead of naming a user who was asleep.';
-
-REVOKE ALL ON FUNCTION public.service_call_record_for(text, uuid, text, text, integer) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.service_call_record_for(text, uuid, text, text, integer) TO service_role;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §3  What a background reaction has queued
---
--- The consumer runs inside the database and cannot open a socket. So a handler
--- that needs a service does not call it — it ASKS for it, and the same worker
--- that drains the event log drains this. One more row, and the reason it is a
--- row rather than a callback: a service that is down must not roll back the
--- fact that was already recorded.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE TABLE IF NOT EXISTS app.service_requests (
-  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id   uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  service     text NOT NULL REFERENCES app.services(name) ON DELETE CASCADE,
-  payload     jsonb NOT NULL DEFAULT '{}'::jsonb,
-  -- Where the answer goes: a function name the worker calls back with the
-  -- result. NULL means fire-and-forget.
-  callback    text,
-  origin      text NOT NULL DEFAULT 'event' CHECK (origin IN ('event', 'schedule', 'manual')),
-  origin_ref  text,
-  status      text NOT NULL DEFAULT 'queued' CHECK (status IN ('queued', 'sent', 'ok', 'failed', 'refused')),
-  attempts    integer NOT NULL DEFAULT 0,
-  next_try_at timestamptz NOT NULL DEFAULT now(),
-  last_error  text,
-  result      jsonb,
-  created_at  timestamptz NOT NULL DEFAULT now(),
-  updated_at  timestamptz NOT NULL DEFAULT now()
-);
-
-COMMENT ON TABLE app.service_requests IS
-  'Service calls a background reaction asked for (156). A row rather than a callback, so a service being down cannot roll back the fact that caused it.';
-
-CREATE INDEX IF NOT EXISTS service_requests_due ON app.service_requests (next_try_at)
-  WHERE status IN ('queued', 'failed');
-
-ALTER TABLE app.service_requests ENABLE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS service_requests_read ON app.service_requests;
-CREATE POLICY service_requests_read ON app.service_requests
-  FOR SELECT TO authenticated
-  USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT ON app.service_requests TO authenticated;
-GRANT ALL ON app.service_requests TO service_role;
-
-DROP TRIGGER IF EXISTS service_requests_updated_at ON app.service_requests;
-CREATE TRIGGER service_requests_updated_at BEFORE UPDATE ON app.service_requests
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
--- What a handler calls. Deliberately cheap: it enqueues and returns, so a
--- handler's transaction never waits on a network it cannot see.
-CREATE OR REPLACE FUNCTION public.service_request(
-  p_tenant uuid, p_service text, p_payload jsonb DEFAULT '{}'::jsonb,
-  p_callback text DEFAULT NULL, p_origin text DEFAULT 'event', p_origin_ref text DEFAULT NULL
-) RETURNS uuid
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_id uuid;
-BEGIN
-  INSERT INTO app.service_requests (tenant_id, service, payload, callback, origin, origin_ref)
-  VALUES (p_tenant, p_service, coalesce(p_payload, '{}'::jsonb), p_callback, p_origin, p_origin_ref)
-  RETURNING id INTO v_id;
-  RETURN v_id;
-END $$;
-
-REVOKE ALL ON FUNCTION public.service_request(uuid, text, jsonb, text, text, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.service_request(uuid, text, jsonb, text, text, text) TO service_role;
-
--- What the worker drains. Same shape as consume_event_log: SKIP LOCKED so two
--- workers do not fight, and a claim that marks before the call so a crash
--- cannot produce a second identical request.
-CREATE OR REPLACE FUNCTION public.claim_service_requests(p_limit integer DEFAULT 20)
-RETURNS TABLE (id uuid, tenant_id uuid, service text, payload jsonb, callback text, attempts integer)
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-BEGIN
-  RETURN QUERY
-  WITH claimed AS (
-    SELECT r.id FROM app.service_requests r
-     WHERE r.status IN ('queued', 'failed')
-       AND r.next_try_at <= now()
-       AND r.attempts < 5
-     ORDER BY r.next_try_at
-     LIMIT greatest(1, least(p_limit, 200))
-     FOR UPDATE SKIP LOCKED
-  )
-  UPDATE app.service_requests r
-     SET status = 'sent', attempts = r.attempts + 1
-    FROM claimed c
-   WHERE r.id = c.id
-  RETURNING r.id, r.tenant_id, r.service, r.payload, r.callback, r.attempts;
-END $$;
-
-REVOKE ALL ON FUNCTION public.claim_service_requests(integer) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.claim_service_requests(integer) TO service_role;
-
-CREATE OR REPLACE FUNCTION public.settle_service_request(
-  p_id uuid, p_status text, p_result jsonb DEFAULT NULL, p_error text DEFAULT NULL
-) RETURNS void
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-BEGIN
-  UPDATE app.service_requests
-     SET status = p_status,
-         result = coalesce(p_result, result),
-         last_error = p_error,
-         -- Same capped backoff as the event consumer, for the same reason: a
-         -- service that is down for an hour must not be hammered for an hour.
-         next_try_at = CASE WHEN p_status = 'failed'
-                            THEN now() + least(interval '1 hour',
-                                               (power(2, attempts + 1)::text || ' seconds')::interval)
-                            ELSE next_try_at END
-   WHERE id = p_id;
-END $$;
-
-REVOKE ALL ON FUNCTION public.settle_service_request(uuid, text, jsonb, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.settle_service_request(uuid, text, jsonb, text) TO service_role;
-
--- The one place to look when a background reaction did not happen.
-CREATE OR REPLACE VIEW public.v_service_queue
-WITH (security_invoker = true) AS
-  SELECT r.tenant_id, r.service, r.status, r.origin, r.origin_ref,
-         r.attempts, r.next_try_at, r.last_error, r.created_at
-    FROM app.service_requests r
-   WHERE r.status <> 'ok'
-   ORDER BY r.created_at DESC;
-
-COMMENT ON VIEW public.v_service_queue IS
-  'Background service calls that have not succeeded (156) — the answer to "why did the reaction not happen?", in one place instead of per plugin.';
-
-GRANT SELECT ON public.v_service_queue TO authenticated, service_role;

package/migrations/157_nobody_creates_objects_in_public.sql

@@ -1,74 +0,0 @@
--- ---------------------------------------------------------------------------
--- 157_nobody_creates_objects_in_public.sql — the other half of the definer rule
--- (#283).
---
--- `SECURITY DEFINER` without a pinned `search_path` is the classic escalation
--- shape: the function runs as its owner, and resolves unqualified names using
--- the CALLER's path. An attacker who can create `public.now()` — or anything
--- else the body calls unqualified — gets it executed as the owner.
---
--- Pinning the path on every definer function is the direct fix, and the plugins
--- do that in their own migrations. This file removes the other precondition:
--- the ability to create the shadowing object at all.
---
--- Postgres 15 already stopped granting CREATE on `public` to PUBLIC, so on a
--- current cluster this is a no-op that documents an assumption. It is written
--- down anyway because "it is the default" is exactly the kind of belief that
--- silently stops being true — a restore from an older dump, a pool created
--- before an upgrade, a `GRANT` somebody added for one migration and left.
--- Cheap to assert, and asserting it is what makes the definer rule complete.
---
--- Nothing legitimate loses anything: migrations run as the owner, and the owner
--- keeps CREATE. What loses is `authenticated` planting a function in the path
--- of one that runs as somebody else.
--- ---------------------------------------------------------------------------
-
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'public') THEN
-    RETURN;
-  END IF;
-
-  REVOKE CREATE ON SCHEMA public FROM PUBLIC;
-  -- Named explicitly as well: a role holding it directly is not covered by the
-  -- revoke from PUBLIC, and that is the case somebody's one-off GRANT creates.
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
-    REVOKE CREATE ON SCHEMA public FROM anon;
-  END IF;
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
-    REVOKE CREATE ON SCHEMA public FROM authenticated;
-  END IF;
-END $$;
-
-COMMENT ON SCHEMA public IS
-  'The archetype schema. No role below the owner may CREATE here (157): a SECURITY DEFINER function resolving an unqualified name is only exploitable if somebody else can plant the object it resolves to.';
-
--- ─────────────────────────────────────────────────────────────────────────
--- The census: which definer functions still resolve names loosely.
---
--- The CI gate reads the repository, which is where a fix belongs. This reads
--- the live catalog, which is where the truth is — a pool carries functions from
--- versions the repository has moved past, and a plugin uninstalled from the
--- code does not uninstall itself from the database.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE OR REPLACE VIEW public.v_definer_functions_unpinned
-WITH (security_invoker = true) AS
-  SELECT n.nspname AS schema_name,
-         p.proname AS function_name,
-         pg_get_function_identity_arguments(p.oid) AS arguments,
-         pg_get_userbyid(p.proowner) AS owner
-    FROM pg_proc p
-    JOIN pg_namespace n ON n.oid = p.pronamespace
-   WHERE p.prosecdef
-     AND n.nspname IN ('public', 'app')
-     AND NOT EXISTS (
-       SELECT 1 FROM unnest(coalesce(p.proconfig, ARRAY[]::text[])) AS cfg
-        WHERE cfg LIKE 'search\_path=%'
-     )
-   ORDER BY n.nspname, p.proname;
-
-COMMENT ON VIEW public.v_definer_functions_unpinned IS
-  'SECURITY DEFINER functions in this database whose search_path is not pinned (157, #283). Zero is the target; a row here is a function that runs as its owner and resolves unqualified names as the caller.';
-
-GRANT SELECT ON public.v_definer_functions_unpinned TO service_role;

package/migrations/158_the_registry_owns_the_status_vocabulary.sql

@@ -1,153 +0,0 @@
--- ---------------------------------------------------------------------------
--- 158_the_registry_owns_the_status_vocabulary.sql — the base takes back the one
--- constraint that forced plugins to write a base table (#283, #274).
---
--- ── The thing that was wrong ────────────────────────────────────────────────
--- A beauty-era migration put `orders_kind_status_valid` on public.orders: a
--- CHECK whose body is a CASE over `kind`, listing the statuses each kind may
--- have. Every time a plugin gained a status, the only way to say so was to DROP
--- and re-ADD a constraint on an archetype the base owns — which plugin-crm did
--- twice (009 for `archived` on a deal, 010 for the same on a quote), each time
--- rewriting the branch for every OTHER plugin's kinds in the process.
---
--- That is not a plugin behaving badly. It is a base that left no other door.
--- The rule "a plugin does not restructure a base table" is only fair once the
--- base provides the mechanism, and since 090 it does: `order_kinds.statuses` is
--- the per-kind vocabulary, and `trg_orders_kind_guard` already enforces it on
--- every INSERT and UPDATE. The CHECK was a second opinion about the same fact —
--- and the more expensive of the two, because widening it needed DDL on a table
--- other plugins were writing at the time.
---
--- ── What this does, in order ───────────────────────────────────────────────
--- 1. Reads the CHECK, if the pool has one, and folds any status it allowed into
---    the registry. Nothing loosens and nothing tightens: a vocabulary the pool
---    accepted yesterday is accepted today, now written where it can be read.
--- 2. Drops the constraint.
--- 3. Records the retirement, so the review gate can tell a historical ALTER
---    from a new one instead of being handed a list of names to ignore.
---
--- Pools that never had the constraint — most of them — take only step 3.
--- ---------------------------------------------------------------------------
-
--- ─────────────────────────────────────────────────────────────────────────
--- §1  Fold the CHECK's vocabulary into the registry
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-DECLARE
-  v_def      text;
-  v_branch   text;
-  v_kind     text;
-  v_statuses text[];
-  v_added    integer := 0;
-BEGIN
-  IF to_regclass('public.orders') IS NULL OR to_regclass('public.order_kinds') IS NULL THEN
-    RETURN;
-  END IF;
-
-  SELECT pg_get_constraintdef(c.oid) INTO v_def
-    FROM pg_constraint c
-   WHERE c.conname = 'orders_kind_status_valid'
-     AND c.conrelid = 'public.orders'::regclass;
-
-  IF v_def IS NULL THEN
-    RAISE NOTICE '158: no orders_kind_status_valid on this pool — nothing to fold';
-    RETURN;
-  END IF;
-
-  -- The CHECK's shape is fixed and known: WHEN 'kind' THEN status IN (…). Read
-  -- it rather than hard-coding a list, because what matters is what THIS pool
-  -- accepts — a pool that ran only some of the widening migrations has a
-  -- narrower CHECK than the newest file describes, and copying the file's list
-  -- would silently widen it.
-  FOR v_branch IN
-    SELECT m[1] || '|' || m[2]
-      FROM regexp_matches(v_def, $re$WHEN '([a-z_]+)'::text THEN status = ANY \(ARRAY\[([^\]]*)\]\)$re$, 'g') AS m
-  LOOP
-    v_kind := split_part(v_branch, '|', 1);
-    SELECT array_agg(DISTINCT btrim(btrim(s), ''''))
-      INTO v_statuses
-      FROM unnest(string_to_array(split_part(v_branch, '|', 2), ',')) AS s
-     WHERE btrim(s) <> '';
-
-    -- Fold, never replace: the union of what the CHECK allowed and what the
-    -- registry already knew. Either source having a status is enough.
-    UPDATE public.order_kinds k
-       SET statuses = (
-             SELECT array_agg(DISTINCT x)
-               FROM unnest(coalesce(k.statuses, ARRAY[]::text[]) || v_statuses) AS x
-           )
-     WHERE k.kind = v_kind
-       AND v_statuses IS NOT NULL
-       AND NOT (coalesce(k.statuses, ARRAY[]::text[]) @> v_statuses);
-    v_added := v_added + 1;
-  END LOOP;
-
-  RAISE NOTICE '158: folded % kind branch(es) from orders_kind_status_valid into order_kinds.statuses', v_added;
-END $$;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §2  Drop it
---
--- Safe because 090's trigger has been enforcing the same rule from the registry
--- since it landed: what goes away is a duplicate, not the enforcement.
--- ─────────────────────────────────────────────────────────────────────────
-
-DO $$
-BEGIN
-  IF to_regclass('public.orders') IS NULL THEN RETURN; END IF;
-  IF EXISTS (
-    SELECT 1 FROM pg_constraint
-     WHERE conname = 'orders_kind_status_valid'
-       AND conrelid = 'public.orders'::regclass
-  ) THEN
-    ALTER TABLE public.orders DROP CONSTRAINT orders_kind_status_valid;
-    RAISE NOTICE '158: dropped orders_kind_status_valid — order_kinds.statuses is the vocabulary now';
-  END IF;
-END $$;
-
--- ─────────────────────────────────────────────────────────────────────────
--- §3  Record the retirement
---
--- 148 gave the base a place to say which unprefixed names it owns, and the
--- review gate reads it rather than carrying a list of its own. This is the same
--- move one level down: a constraint the base has taken back, so a plugin's
--- historical ALTER that names it can be told apart from a new one — by a rule
--- the base states, not by an entry somebody added to the gate.
--- ─────────────────────────────────────────────────────────────────────────
-
-CREATE TABLE IF NOT EXISTS app.retired_base_constraints (
-  constraint_name text PRIMARY KEY,
-  table_name      text NOT NULL,
-  retired_in      text NOT NULL,
-  reason          text NOT NULL,
-  created_at      timestamptz NOT NULL DEFAULT now()
-);
-
-COMMENT ON TABLE app.retired_base_constraints IS
-  'Constraints on base tables that the base has withdrawn, and what replaced them (158). A plugin migration that alters one is history; a plugin migration that alters anything else is a violation. The review gate reads this instead of keeping its own list.';
-
-ALTER TABLE app.retired_base_constraints ENABLE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS retired_base_constraints_read ON app.retired_base_constraints;
-CREATE POLICY retired_base_constraints_read ON app.retired_base_constraints
-  FOR SELECT TO authenticated, service_role USING (true);
-GRANT SELECT ON app.retired_base_constraints TO authenticated, service_role;
-
-INSERT INTO app.retired_base_constraints (constraint_name, table_name, retired_in, reason) VALUES
-  ('orders_kind_status_valid', 'orders', '158',
-   'A CASE-over-kind CHECK duplicating what order_kinds.statuses says and trg_orders_kind_guard has enforced since 090. Widening it needed DDL on a base table, which is why two plugin migrations hold an ALTER TABLE public.orders. The registry is the vocabulary now: a plugin widens its own kind by updating its own row.')
-ON CONFLICT (constraint_name) DO UPDATE
-  SET table_name = EXCLUDED.table_name, retired_in = EXCLUDED.retired_in, reason = EXCLUDED.reason;
-
--- The census, for a pool: has anything put it back?
-CREATE OR REPLACE VIEW public.v_retired_constraints_resurrected
-WITH (security_invoker = true) AS
-  SELECT r.constraint_name, r.table_name, r.retired_in, r.reason
-    FROM app.retired_base_constraints r
-    JOIN pg_constraint c ON c.conname = r.constraint_name
-    JOIN pg_class t ON t.oid = c.conrelid AND t.relname = r.table_name;
-
-COMMENT ON VIEW public.v_retired_constraints_resurrected IS
-  'Retired base constraints that exist again in this database (158). Zero is the expected reading; a row means a migration re-created something the base withdrew.';
-
-GRANT SELECT ON public.v_retired_constraints_resurrected TO authenticated, service_role;