@fayz-ai/plugin-clinical 0.2.0

package/dist/index.js

@@ -0,0 +1,3487 @@
+import { definePlugin } from '@fayz-ai/core';
+
+// src/index.ts
+
+// src/migrations/index.ts
+var MIGRATION_001_O_ATENDIMENTO_CLINICO_TEM_ONDE_MORAR = `-- O atendimento cl\xEDnico tem onde morar.
+--
+-- 358.577 linhas do Espa\xE7o Facial n\xE3o tinham destino nenhum no V2 \u2014 96% de tudo
+-- que ainda falta portar daquele tenant. N\xE3o era uma tabela esquecida: era um
+-- DOM\xCDNIO inteiro sem casa.
+--
+--     journey_executions        233.934   a sess\xE3o de execu\xE7\xE3o
+--     execution_products        117.011   o produto consumido na sess\xE3o
+--     execution_requirements      6.590   o que trava come\xE7ar e terminar
+--     service_revisions             110   a vers\xE3o do servi\xE7o (pre\xE7o, prazo)
+--     service_revision_forms         87   os formul\xE1rios daquela vers\xE3o
+--     prepaid_item_outcomes          30   o desfecho do item contratado
+--
+-- \u2500\u2500 Por que n\xE3o \xE9 a agenda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A agenda termina em QUEM, QUANDO e ONDE \u2014 \`appointments\` e
+-- \`appointment_items\`, que j\xE1 atravessaram na migration 008. O que est\xE1 aqui \xE9
+-- O QUE FOI FEITO, e tem ciclo de vida pr\xF3prio: revis\xE3o com pai
+-- (\`parent_execution_id\`), requisitos que bloqueiam in\xEDcio e fim, consumo de
+-- produto auditado contra o estoque, foto por pose.
+--
+-- A jornada est\xE1 documentada em
+-- ~/dev/beautyplace/docs/v1-guide/jornadas/avaliacao-e-contratacao/FLOW.md
+-- (\`v2.status: missing\`): anamnese COM VALIDADE \u2192 avalia\xE7\xE3o com desenho do rosto
+-- e foto \u2192 indica\xE7\xE3o com quantidade \u2192 "o que o cliente deseja contratar" \u2192
+-- contrato assinado e termo de sess\xE3o \u2192 executar s\xF3 o que couber hoje \u2192 r\xE9gua de
+-- etapas com cron\xF4metro e evolu\xE7\xE3o cl\xEDnica.
+--
+-- \xC9 capacidade de VERTICAL (est\xE9tica, sa\xFAde), n\xE3o do n\xFAcleo. Por isso plugin
+-- pr\xF3prio e entrada em \`optional\` no chain.json, como o workforce.
+--
+-- \u2500\u2500 O que N\xC3O \xE9 deste dom\xEDnio, apesar do nome \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`journeys\` e \`journey_steps\` compartilham o prefixo com \`journey_executions\` e
+-- n\xE3o t\xEAm rela\xE7\xE3o nenhuma com ele: ZERO chave estrangeira entre os dois, e
+-- \`journey_steps\` aponta para \`message_templates\` carregando \`wait_value\`,
+-- \`channel\`, \`quiet_hours_start\` e \`cooldown_days\`. \xC9 automa\xE7\xE3o de COMUNICA\xC7\xC3O,
+-- e o destino dela \xE9 \`plg_automations_flows\`, que j\xE1 existe. S\xE3o 7 linhas, e a
+-- tela delas no V1 nem abre (V1-027).
+--
+-- \u2500\u2500 As colunas que ficaram para tr\xE1s, e por qu\xEA \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Medido no tenant 1 em 21/09/2026:
+--
+--   \`execution_products.stock_deducted\`     0 de 117.015 verdadeiras
+--   \`execution_products.stock_movement_id\`  0 preenchidas
+--   \`execution_products.stock_position_id\`  0 preenchidas
+--   \`position_allocations\` / \`unit_label_allocations\`  0 preenchidas
+--
+-- O consumo NUNCA deu baixa no estoque neste tenant. Isso n\xE3o \xE9 defeito do
+-- porte: \xE9 o que o pr\xF3prio Guia do V1 descreve na jornada
+-- \`auditoria-de-uso-e-estoque\`, onde a auditoria \xE9 port\xE3o PR\xC9-baixa e a baixa
+-- fica pendurada. Trazer colunas vazias faria a tela do V2 afirmar que existe um
+-- v\xEDnculo com o raz\xE3o que nunca existiu. O dia em que houver baixa, ela vira
+-- \`plg_inventory_stock_movements\` com \`subject_id\` apontando para a sess\xE3o.
+--
+--   \`journey_executions.product_id\`         0 de 233.950 \u2014 coluna morta
+--   \`journey_executions.status\`             redundante com \`journey_status\`, que
+--                                           \xE9 mais granular (separa quoted de
+--                                           contracted). Vai para metadata.
+--   \`execution_photos\` / \`consumption_photos\`  s\xE3o ARQUIVO, e arquivo no V2 \xE9
+--     \`public.documents\`. S\xE3o muitos por sess\xE3o, cada um com a sua pose, ent\xE3o o
+--     v\xEDnculo \xE9 \`documents.subject_type\`/\`subject_id\` \u2014 e n\xE3o uma coluna de
+--     array que nenhuma RLS de arquivo alcan\xE7a.
+--
+-- Idempotente.
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 1. A sess\xE3o
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_clinical_sessions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    -- O \`journey_status\` do V1. Fechado num CHECK porque \xE9 vocabul\xE1rio de
+    -- plugin, n\xE3o arqu\xE9tipo \u2014 \`schedule_kinds\`/\`appointment_kinds\` s\xE3o registros
+    -- de esp\xE9cie, e uma sess\xE3o cl\xEDnica n\xE3o \xE9 esp\xE9cie de nada.
+    status text DEFAULT 'pending'::text NOT NULL,
+    -- O agendamento: 226.551 de 233.950 (96,8%). Os que faltam s\xE3o sess\xE3o sem
+    -- agenda \u2014 contratada e ainda n\xE3o marcada.
+    booking_id uuid,
+    -- O item do agendamento: 2.511 de 233.950. Raro no V1 e mantido assim: o
+    -- v\xEDnculo forte com o que foi vendido \xE9 \`order_item_id\`.
+    booking_item_id uuid,
+    party_id uuid,
+    -- Quem estava marcado e quem de fato executou s\xE3o duas perguntas. O V1
+    -- guarda as duas (\`professional_id\`, \`execution_professional_id\`) e a
+    -- segunda s\xF3 existe em 148.414 \u2014 \xE9 ela que a comiss\xE3o l\xEA.
+    assignee_id uuid,
+    performed_by_id uuid,
+    service_id uuid,
+    order_item_id uuid,
+    quote_item_id uuid,
+    -- 233.281 de 233.950 (99,7%) t\xEAm oportunidade. A sess\xE3o pendura no NEG\xD3CIO
+    -- antes de pendurar na agenda, e \xE9 por isso que ela existe para o que foi
+    -- or\xE7ado e nunca marcado.
+    deal_id uuid,
+    revision_number integer DEFAULT 1 NOT NULL,
+    parent_session_id uuid,
+    source_evaluation_id uuid,
+    scheduled_for date,
+    started_at timestamp with time zone,
+    ended_at timestamp with time zone,
+    products_initialized boolean DEFAULT false NOT NULL,
+    notes text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_clinical_sessions_status_check CHECK (status = ANY (ARRAY[
+      'quoted'::text, 'contracted'::text, 'scheduled'::text, 'in_service'::text,
+      'in_progress'::text, 'executed'::text, 'pending'::text])),
+    CONSTRAINT plg_clinical_sessions_revision_check CHECK (revision_number >= 1),
+    -- A sess\xE3o termina depois de come\xE7ar. O V1 n\xE3o cobra isso e por isso a
+    -- recusa vive no writer do porte, n\xE3o aqui \u2014 mas daqui para frente vale.
+    CONSTRAINT plg_clinical_sessions_window_check
+      CHECK (started_at IS NULL OR ended_at IS NULL OR ended_at >= started_at)
+);
+
+COMMENT ON TABLE public.plg_clinical_sessions IS
+  'A sess\xE3o de execu\xE7\xE3o do atendimento cl\xEDnico. V1: journey_executions \u2014 que N\xC3O tem rela\xE7\xE3o com journeys, apesar do nome.';
+COMMENT ON COLUMN public.plg_clinical_sessions.performed_by_id IS
+  'V1: execution_professional_id \u2014 quem de fato executou, que pode n\xE3o ser quem estava marcado.';
+COMMENT ON COLUMN public.plg_clinical_sessions.source_evaluation_id IS
+  'V1: source_evaluation_execution_id \u2014 a avalia\xE7\xE3o que originou esta indica\xE7\xE3o.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 2. O produto consumido
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_clinical_session_products (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    session_id uuid NOT NULL,
+    product_id uuid NOT NULL,
+    order_item_id uuid,
+    assignee_id uuid,
+    -- O "Padr\xE3o: N" da ficha t\xE9cnica contra o que a profissional realmente usou.
+    -- \xC9 a diferen\xE7a entre os dois que a auditoria de consumo l\xEA.
+    default_quantity numeric(14,4),
+    used_quantity numeric(14,4),
+    used_unit_id uuid,
+    executed_on date,
+    is_audited boolean DEFAULT false NOT NULL,
+    audited_at timestamp with time zone,
+    audited_by uuid,
+    audit_notes text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_clinical_session_products_qty_check
+      CHECK (used_quantity IS NULL OR used_quantity >= 0)
+);
+
+COMMENT ON TABLE public.plg_clinical_session_products IS
+  'O produto consumido na sess\xE3o, com o padr\xE3o da ficha t\xE9cnica ao lado do usado. V1: execution_products. As colunas de baixa de estoque n\xE3o vieram: 0 de 117.015 estavam preenchidas.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 3. O que trava come\xE7ar e terminar
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_clinical_requirements (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    session_id uuid,
+    booking_id uuid,
+    party_id uuid,
+    service_id uuid,
+    kind text NOT NULL,
+    scope text NOT NULL,
+    -- As duas travas do V1, e elas s\xE3o diferentes: a anamnese impede COME\xC7AR, o
+    -- termo de sess\xE3o impede TERMINAR. 1.107 e 1.023 linhas no tenant 1.
+    blocks_start boolean DEFAULT false NOT NULL,
+    blocks_finish boolean DEFAULT false NOT NULL,
+    status text DEFAULT 'pending'::text NOT NULL,
+    -- O que resolveu a exig\xEAncia \xE9 polim\xF3rfico no V1 (\`resolved_table\` +
+    -- \`resolved_id\`) e continua sendo aqui, com o mesmo par que
+    -- \`public.documents\` j\xE1 usa. Um formul\xE1rio resolve por uma linha de
+    -- plg_forms_documents; um contrato, por outra.
+    subject_type text,
+    subject_id uuid,
+    candidate_type text,
+    candidate_id uuid,
+    resolved_via text,
+    resolved_at timestamp with time zone,
+    -- A anamnese vale at\xE9 uma data ("V\xE1lido at\xE9 08/03/2027"), e \xE9 isso que
+    -- solta o resto da r\xE9gua.
+    valid_until timestamp with time zone,
+    frozen_at timestamp with time zone,
+    rule_sources jsonb DEFAULT '[]'::jsonb NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_clinical_requirements_kind_check CHECK (kind = ANY (ARRAY[
+      'form'::text, 'evaluation'::text, 'contract'::text, 'session_term'::text,
+      'products'::text, 'invoice_item'::text, 'revision_link'::text])),
+    CONSTRAINT plg_clinical_requirements_scope_check
+      CHECK (scope = ANY (ARRAY['service'::text, 'attendance'::text])),
+    CONSTRAINT plg_clinical_requirements_status_check CHECK (status = ANY (ARRAY[
+      'pending'::text, 'resolved'::text, 'not_applicable'::text]))
+);
+
+COMMENT ON TABLE public.plg_clinical_requirements IS
+  'A exig\xEAncia que trava o in\xEDcio ou o fim do atendimento \u2014 anamnese, avalia\xE7\xE3o, contrato, termo, kit. V1: execution_requirements.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 4. A vers\xE3o do servi\xE7o
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- O servi\xE7o muda de pre\xE7o e de prazo, e o que foi contratado tem de continuar
+-- valendo o que valia. A revis\xE3o \xE9 o congelamento \u2014 e ela carrega os
+-- formul\xE1rios que aquela vers\xE3o exigia.
+CREATE TABLE IF NOT EXISTS public.plg_clinical_service_revisions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    service_id uuid NOT NULL,
+    revision_number integer NOT NULL,
+    price numeric(14,2),
+    duration_minutes integer,
+    deadline_days integer,
+    -- Os \`service_revision_forms\` daquela revis\xE3o. S\xE3o 87 linhas em 110
+    -- revis\xF5es: uma lista curta, sem vida pr\xF3pria e sem tela \u2014 jsonb em vez de
+    -- uma quarta tabela que ningu\xE9m consulta sozinha.
+    form_template_refs jsonb DEFAULT '[]'::jsonb NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_clinical_service_revisions_number_check CHECK (revision_number >= 1)
+);
+
+COMMENT ON TABLE public.plg_clinical_service_revisions IS
+  'A vers\xE3o congelada do servi\xE7o \u2014 pre\xE7o, dura\xE7\xE3o e prazo no momento da contrata\xE7\xE3o. V1: service_revisions + service_revision_forms.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 5. O desfecho do que foi contratado e n\xE3o executado
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_clinical_prepaid_outcomes (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    booking_id uuid,
+    order_item_id uuid,
+    outcome text NOT NULL,
+    reason text,
+    decided_by uuid,
+    decided_at timestamp with time zone DEFAULT now() NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_clinical_prepaid_outcomes_check CHECK (outcome = ANY (ARRAY[
+      'contracted'::text, 'declined'::text, 'postponed'::text]))
+);
+
+COMMENT ON TABLE public.plg_clinical_prepaid_outcomes IS
+  'O que aconteceu com o servi\xE7o contratado e n\xE3o executado no dia \u2014 contratado, recusado ou adiado. V1: prepaid_item_outcomes.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 6. As chaves
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Toda FK para uma tabela escopada por unidade \xE9 COMPOSTA (tenant_id, id): \xE9
+-- ela que impede a sess\xE3o de uma casa apontar para o agendamento de outra. Onde
+-- a refer\xEAncia \xE9 opcional, \`ON DELETE SET NULL\` \u2014 apagar o agendamento n\xE3o pode
+-- levar o prontu\xE1rio junto.
+DO $$
+DECLARE
+  t text;
+  tabelas text[] := ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
+                          'plg_clinical_requirements', 'plg_clinical_service_revisions',
+                          'plg_clinical_prepaid_outcomes'];
+BEGIN
+  FOREACH t IN ARRAY tabelas LOOP
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                    WHERE conrelid = ('public.' || t)::regclass AND contype = 'p') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I PRIMARY KEY (id)', t, t || '_pkey');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_id_id_key') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I UNIQUE (tenant_id, id)', t, t || '_tenant_id_id_key');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_fkey') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE', t, t || '_tenant_fkey');
+    END IF;
+  END LOOP;
+END $$;
+
+DO $$ BEGIN
+  -- sess\xF5es
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_booking_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_booking_fkey
+      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_booking_item_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_booking_item_fkey
+      FOREIGN KEY (booking_item_id) REFERENCES public.appointment_items(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_party_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_party_fkey
+      FOREIGN KEY (party_id) REFERENCES public.people(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_assignee_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_assignee_fkey
+      FOREIGN KEY (assignee_id) REFERENCES public.people(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_performed_by_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_performed_by_fkey
+      FOREIGN KEY (performed_by_id) REFERENCES public.people(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_service_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_service_fkey
+      FOREIGN KEY (service_id) REFERENCES public.products(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_order_item_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_order_item_fkey
+      FOREIGN KEY (order_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_quote_item_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_quote_item_fkey
+      FOREIGN KEY (quote_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
+  END IF;
+  -- O pai e a avalia\xE7\xE3o de origem s\xE3o a MESMA tabela. CASCADE aqui apagaria a
+  -- corrente de revis\xF5es inteira ao apagar a primeira; SET NULL deixa as filhas
+  -- \xF3rf\xE3s e leg\xEDveis, que \xE9 o que um prontu\xE1rio pede.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_parent_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_parent_fkey
+      FOREIGN KEY (parent_session_id) REFERENCES public.plg_clinical_sessions(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_source_eval_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_source_eval_fkey
+      FOREIGN KEY (source_evaluation_id) REFERENCES public.plg_clinical_sessions(id) ON DELETE SET NULL;
+  END IF;
+
+  -- produtos da sess\xE3o: a sess\xE3o some, o consumo some junto \u2014 ele n\xE3o existe fora dela
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_session_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_session_fkey
+      FOREIGN KEY (tenant_id, session_id) REFERENCES public.plg_clinical_sessions(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  -- A UNIDADE DE MEDIDA (SR, UI, mL) MORA NO ESTOQUE, E FICA SEM CHAVE.
+  --
+  -- Havia uma FK para \`plg_inventory_measurement_units\`. Ela amarra dois ciclos
+  -- de release e torna imposs\xEDvel desinstalar o estoque sem derrubar o
+  -- prontu\xE1rio \u2014 a cl\xEDnica que n\xE3o usa estoque passaria a precisar dele. O
+  -- \`used_unit_id\` continua sendo o uuid de l\xE1; quem quiser o s\xEDmbolo resolve
+  -- na leitura, e unidade apagada vira n\xFAmero sem r\xF3tulo em vez de escrita
+  -- recusada.
+  ALTER TABLE public.plg_clinical_session_products
+    DROP CONSTRAINT IF EXISTS plg_clinical_session_products_uom_fkey;
+
+  -- exig\xEAncias
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_session_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_session_fkey
+      FOREIGN KEY (tenant_id, session_id) REFERENCES public.plg_clinical_sessions(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_booking_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_booking_fkey
+      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+
+  -- revis\xE3o do servi\xE7o: uma por (servi\xE7o, n\xFAmero)
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_service_revisions_service_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_service_revisions ADD CONSTRAINT plg_clinical_service_revisions_service_fkey
+      FOREIGN KEY (service_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+
+  -- desfecho
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_booking_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_booking_fkey
+      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_item_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_item_fkey
+      FOREIGN KEY (order_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS plg_clinical_service_revisions_service_number_key
+  ON public.plg_clinical_service_revisions USING btree (tenant_id, service_id, revision_number);
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 7. Os \xEDndices das tr\xEAs perguntas que a tela faz
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- "o que aconteceu com esta paciente" \xB7 "o que falta neste atendimento" \xB7
+-- "quanto deste produto saiu". Com 233 mil sess\xF5es numa rede de 63 unidades,
+-- cada uma dessas sem \xEDndice \xE9 uma varredura.
+CREATE INDEX IF NOT EXISTS plg_clinical_sessions_party_idx
+  ON public.plg_clinical_sessions USING btree (tenant_id, party_id, scheduled_for DESC);
+CREATE INDEX IF NOT EXISTS plg_clinical_sessions_booking_idx
+  ON public.plg_clinical_sessions USING btree (tenant_id, booking_id) WHERE booking_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS plg_clinical_sessions_unit_status_idx
+  ON public.plg_clinical_sessions USING btree (tenant_id, unit_id, status, scheduled_for DESC);
+CREATE INDEX IF NOT EXISTS plg_clinical_sessions_deal_idx
+  ON public.plg_clinical_sessions USING btree (tenant_id, deal_id) WHERE deal_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_session_idx
+  ON public.plg_clinical_session_products USING btree (tenant_id, session_id);
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_product_idx
+  ON public.plg_clinical_session_products USING btree (tenant_id, product_id, executed_on DESC);
+CREATE INDEX IF NOT EXISTS plg_clinical_requirements_session_idx
+  ON public.plg_clinical_requirements USING btree (tenant_id, session_id, status);
+CREATE INDEX IF NOT EXISTS plg_clinical_requirements_booking_pending_idx
+  ON public.plg_clinical_requirements USING btree (tenant_id, booking_id)
+  WHERE status = 'pending'::text;
+
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
+                           'plg_clinical_requirements', 'plg_clinical_service_revisions',
+                           'plg_clinical_prepaid_outcomes'] LOOP
+    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', t || '_updated_at', t);
+    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()', t || '_updated_at', t);
+  END LOOP;
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 8. Quem enxerga o prontu\xE1rio
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Escopo de UNIDADE nas quatro tabelas que t\xEAm unidade, e permiss\xE3o pr\xF3pria:
+-- \`clinical.read\` n\xE3o \xE9 \`agenda.read\`. Quem marca hor\xE1rio n\xE3o l\xEA anamnese.
+--
+-- A revis\xE3o do servi\xE7o \xE9 a exce\xE7\xE3o: ela \xE9 do CAT\xC1LOGO, n\xE3o de uma filial \u2014 o
+-- pre\xE7o congelado de um servi\xE7o vale na rede inteira, e escond\xEA-lo por unidade
+-- faria a fatura de ontem virar um n\xFAmero sem origem.
+-- As cinco, uma a uma e por extenso. O la\xE7o abaixo j\xE1 liga tudo isto \u2014 mas ele
+-- liga por \`EXECUTE format(...)\`, e o port\xE3o que revisa plugin l\xEA o ARQUIVO,
+-- n\xE3o o banco: para ele, tabela com tenant_id e sem um ENABLE literal \xE9 tabela
+-- aberta. Uma garantia que o revisor n\xE3o consegue ler \xE9 uma garantia que
+-- ningu\xE9m confere.
+ALTER TABLE public.plg_clinical_sessions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_clinical_session_products ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_clinical_requirements ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_clinical_service_revisions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_clinical_prepaid_outcomes ENABLE ROW LEVEL SECURITY;
+
+DO $$
+DECLARE
+  t text;
+  unidade boolean;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
+                           'plg_clinical_requirements', 'plg_clinical_service_revisions',
+                           'plg_clinical_prepaid_outcomes'] LOOP
+    unidade := t <> 'plg_clinical_service_revisions';
+    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', t);
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO authenticated', t);
+    EXECUTE format('GRANT ALL ON TABLE public.%I TO service_role', t);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_select', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('clinical.read', %s)))$f$,
+      t || '_authz_select', t,
+      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_insert', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR INSERT TO authenticated WITH CHECK (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('clinical.create', %s)))$f$,
+      t || '_authz_insert', t,
+      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_update', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR UPDATE TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('clinical.edit', %s)))
+      WITH CHECK (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (SELECT app.has_permission('clinical.edit', %s)))$f$,
+      t || '_authz_update', t,
+      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END,
+      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_delete', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR DELETE TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('clinical.delete', %s)))$f$,
+      t || '_authz_delete', t,
+      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+  END LOOP;
+END $$;
+
+-- \`owner_id\` s\xF3 na sess\xE3o, e \`shareable\` falso: um prontu\xE1rio n\xE3o se compartilha
+-- por tupla \u2014 ou a pessoa atende naquela unidade, ou n\xE3o l\xEA.
+INSERT INTO public.scoped_resources (resource_table, unit_column, owner_column, shareable, default_visibility, label)
+VALUES ('plg_clinical_sessions', 'unit_id', 'owner_id', false, 'unit', 'Atendimentos cl\xEDnicos')
+ON CONFLICT (resource_table) DO UPDATE
+  SET unit_column = EXCLUDED.unit_column, default_visibility = EXCLUDED.default_visibility, label = EXCLUDED.label;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 9. A permiss\xE3o existe antes da pol\xEDtica precisar dela
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- \`clinical.read\` n\xE3o \xE9 \`agenda.read\`, e a diferen\xE7a \xE9 o ponto: a recep\xE7\xE3o marca
+-- hor\xE1rio e N\xC3O l\xEA anamnese. Quem hoje tem \`agenda.*\` num papel herda o
+-- equivalente cl\xEDnico, porque \xE9 quem atende \u2014 e quem quiser separar recep\xE7\xE3o de
+-- profissional tira a linha do papel, que \xE9 uma decis\xE3o de uma tela, n\xE3o de uma
+-- migration.
+INSERT INTO app.permissions (key, plugin, description, owner_only) VALUES
+  ('clinical.read',     'clinical', 'Prontu\xE1rio: ler o atendimento, a anamnese e o consumo', false),
+  ('clinical.read_all', 'clinical', 'Prontu\xE1rio: ler o de todas as unidades',                false),
+  ('clinical.create',   'clinical', 'Prontu\xE1rio: abrir sess\xE3o e registrar consumo',          false),
+  ('clinical.edit',     'clinical', 'Prontu\xE1rio: corrigir sess\xE3o, consumo e exig\xEAncia',      false),
+  ('clinical.delete',   'clinical', 'Prontu\xE1rio: apagar',                                    false),
+  ('clinical.manage',   'clinical', 'Prontu\xE1rio: administrar',                               false)
+ON CONFLICT (key) DO UPDATE SET plugin = EXCLUDED.plugin, description = EXCLUDED.description;
+
+INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+SELECT rp.tenant_id, rp.role_id, replace(rp.permission, 'agenda.', 'clinical.')
+  FROM app.role_permissions rp
+ WHERE rp.permission IN ('agenda.read', 'agenda.read_all', 'agenda.create',
+                         'agenda.edit', 'agenda.delete', 'agenda.manage')
+ON CONFLICT DO NOTHING;
+`;
+var MIGRATION_002_O_PRONTUARIO_DO_V1_ATRAVESSA = `-- O prontu\xE1rio do V1 atravessa.
+--
+-- A 001 fez as cinco tabelas. Esta faz o TRANSPORTE: os writers do motor de
+-- porte e as cinco linhas do de-para. Sem ela as tabelas existem vazias.
+--
+--     journey_executions        233.934 \u2192 plg_clinical_sessions
+--     execution_products        117.011 \u2192 plg_clinical_session_products
+--     execution_requirements      6.590 \u2192 plg_clinical_requirements
+--     service_revisions             110 \u2192 plg_clinical_service_revisions
+--     service_revision_forms         87 \u2192 (jsonb da revis\xE3o)
+--     prepaid_item_outcomes          30 \u2192 plg_clinical_prepaid_outcomes
+--
+-- \u2500\u2500 Duas tabelas do V1 n\xE3o t\xEAm \`uuid\` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`execution_requirements\` e \`prepaid_item_outcomes\` n\xE3o guardam uuid nenhum \u2014
+-- s\xF3 o id num\xE9rico. O motor j\xE1 sabe lidar com isso (o id do destino nasce
+-- determin\xEDstico da chave da origem), e \xE9 por isso que o de-para delas n\xE3o
+-- mapeia \`uuid\`.
+--
+-- \u2500\u2500 A refer\xEAncia polim\xF3rfica, resolvida em tempo de escrita \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`execution_requirements.resolved_table\` + \`resolved_id\` apontam para uma
+-- tabela QUALQUER, e o \`@tabela\` do de-para \xE9 est\xE1tico. Ent\xE3o quem resolve \xE9 o
+-- writer, lendo o ledger com o nome da tabela que chegou na linha. Medido no
+-- tenant 1:
+--
+--     client_form_responses   2.685   ainda n\xE3o migrou \u2192 fica NULO, com o
+--                                     n\xFAmero cru em metadata
+--     journey_executions      1.048   resolve
+--     generated_contracts       845   ainda n\xE3o migrou
+--     invoice_items             423   resolve
+--     appointments               80   resolve
+--
+-- O n\xFAmero cru fica em \`metadata.clinical.v1_resolved_ref\` de prop\xF3sito: no dia
+-- em que \`client_form_responses\` atravessar, uma passada de costura preenche os
+-- 2.685 sem reler a origem \u2014 foi o que a 011 da agenda fez com a sala.
+--
+-- \u2500\u2500 A revis\xE3o e os formul\xE1rios dela \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 87 linhas de \`service_revision_forms\` em 110 revis\xF5es. Uma lista curta, sem
+-- tela e sem vida pr\xF3pria, ent\xE3o ela entra como jsonb DENTRO da revis\xE3o \u2014 e o
+-- writer que a escreve \xE9 um facet: acha a revis\xE3o pelo ledger e acrescenta,
+-- sem duplicar quando a onda roda de novo.
+--
+-- Idempotente.
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 1. O vocabul\xE1rio fechado aprende quatro palavras
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Por ACR\xC9SCIMO, lendo a defini\xE7\xE3o vigente. Lista literal apaga o que um passo
+-- anterior acrescentou \u2014 \xE9 a armadilha registrada em financial/072 e agenda/008.
+DO $$
+DECLARE v_def text;
+BEGIN
+  SELECT pg_get_constraintdef(oid) INTO v_def
+    FROM pg_constraint WHERE conname = 'allowlist_writer_check';
+  IF v_def IS NULL OR strpos(v_def, 'clinical_session') > 0 THEN RETURN; END IF;
+  ALTER TABLE migration.allowlist DROP CONSTRAINT allowlist_writer_check;
+  EXECUTE replace(
+    'ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check ' || v_def,
+    '''person''::text',
+    '''person''::text, ''clinical_session''::text, ''clinical_session_product''::text, '
+    '''clinical_requirement''::text, ''clinical_service_revision''::text, '
+    '''clinical_revision_form''::text, ''clinical_prepaid_outcome''::text');
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 2. Uma ajuda: resolver refer\xEAncia polim\xF3rfica pelo ledger
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- SECURITY DEFINER porque l\xEA \`migration.ledger\`, que o papel do porte j\xE1
+-- alcan\xE7a mas nenhuma pol\xEDtica de tenant descreve. Devolve NULO quando a linha
+-- de origem ainda n\xE3o atravessou \u2014 e NULO aqui \xE9 resposta, n\xE3o erro.
+CREATE OR REPLACE FUNCTION migration._clinical_resolve(
+  p_tenant uuid, p_table text, p_id text
+) RETURNS uuid
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT l.target_id
+    FROM migration.ledger l
+   WHERE l.tenant_id = p_tenant
+     AND l.source_table = p_table
+     AND l.status = 'migrated'
+     AND l.source_numeric_id = nullif(p_id, '')::bigint
+   LIMIT 1
+$function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 3. O writer da sess\xE3o
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_session(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_status     text  := nullif(p_row ->> 'status', '');
+  v_unit       uuid;
+  v_existing   uuid;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a clinical session needs an id');
+  END IF;
+
+  -- O vocabul\xE1rio \xE9 fechado na tabela. Recusar aqui, com a palavra na m\xE3o, \xE9
+  -- melhor do que deixar a CHECK derrubar o lote sem dizer qual linha.
+  IF v_status IS NULL OR v_status NOT IN ('quoted','contracted','scheduled','in_service','in_progress','executed','pending') THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('clinical session status %L is not one of the seven the V1 writes', v_status));
+  END IF;
+
+  BEGIN v_unit := (p_row ->> 'unit_id')::uuid; EXCEPTION WHEN OTHERS THEN v_unit := NULL; END;
+  -- Sem unidade na linha, a do agendamento serve: \xE9 o mesmo atendimento.
+  IF v_unit IS NULL AND (p_row ->> 'booking_id') IS NOT NULL THEN
+    SELECT a.unit_id INTO v_unit FROM public.appointments a
+     WHERE a.id = (p_row ->> 'booking_id')::uuid AND a.tenant_id = p_tenant;
+  END IF;
+
+  SELECT tenant_id INTO v_existing FROM public.plg_clinical_sessions WHERE id = p_id;
+  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
+      'reason', format('clinical session %s already exists in another tenant', p_id));
+  END IF;
+
+  IF v_existing IS NULL THEN
+    INSERT INTO public.plg_clinical_sessions
+      (id, tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
+       assignee_id, performed_by_id, service_id, order_item_id, quote_item_id, deal_id,
+       revision_number, parent_session_id, source_evaluation_id,
+       scheduled_for, started_at, ended_at, products_initialized, notes,
+       metadata, created_at, updated_at)
+    VALUES
+      (p_id, p_tenant, v_unit, v_status,
+       nullif(p_row ->> 'booking_id', '')::uuid,
+       nullif(p_row ->> 'booking_item_id', '')::uuid,
+       nullif(p_row ->> 'party_id', '')::uuid,
+       nullif(p_row ->> 'assignee_id', '')::uuid,
+       nullif(p_row ->> 'performed_by_id', '')::uuid,
+       nullif(p_row ->> 'service_id', '')::uuid,
+       nullif(p_row ->> 'order_item_id', '')::uuid,
+       nullif(p_row ->> 'quote_item_id', '')::uuid,
+       nullif(p_row ->> 'deal_id', '')::uuid,
+       greatest(coalesce(nullif(p_row ->> 'revision_number', '')::integer, 1), 1),
+       nullif(p_row ->> 'parent_session_id', '')::uuid,
+       nullif(p_row ->> 'source_evaluation_id', '')::uuid,
+       nullif(p_row ->> 'scheduled_for', '')::date,
+       nullif(p_row ->> 'started_at', '')::timestamptz,
+       nullif(p_row ->> 'ended_at', '')::timestamptz,
+       coalesce((p_row ->> 'products_initialized')::boolean, false),
+       p_row ->> 'notes', v_meta,
+       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
+       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
+    v_created := true;
+  ELSE
+    UPDATE public.plg_clinical_sessions SET
+      unit_id              = coalesce(v_unit, unit_id),
+      status               = v_status,
+      booking_id           = coalesce(nullif(p_row ->> 'booking_id', '')::uuid, booking_id),
+      booking_item_id      = coalesce(nullif(p_row ->> 'booking_item_id', '')::uuid, booking_item_id),
+      party_id             = coalesce(nullif(p_row ->> 'party_id', '')::uuid, party_id),
+      assignee_id          = coalesce(nullif(p_row ->> 'assignee_id', '')::uuid, assignee_id),
+      performed_by_id      = coalesce(nullif(p_row ->> 'performed_by_id', '')::uuid, performed_by_id),
+      service_id           = coalesce(nullif(p_row ->> 'service_id', '')::uuid, service_id),
+      order_item_id        = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
+      quote_item_id        = coalesce(nullif(p_row ->> 'quote_item_id', '')::uuid, quote_item_id),
+      deal_id              = coalesce(nullif(p_row ->> 'deal_id', '')::uuid, deal_id),
+      parent_session_id    = coalesce(nullif(p_row ->> 'parent_session_id', '')::uuid, parent_session_id),
+      source_evaluation_id = coalesce(nullif(p_row ->> 'source_evaluation_id', '')::uuid, source_evaluation_id),
+      scheduled_for        = nullif(p_row ->> 'scheduled_for', '')::date,
+      started_at           = nullif(p_row ->> 'started_at', '')::timestamptz,
+      ended_at             = nullif(p_row ->> 'ended_at', '')::timestamptz,
+      products_initialized = coalesce((p_row ->> 'products_initialized')::boolean, products_initialized),
+      notes                = CASE WHEN p_row ? 'notes' THEN p_row ->> 'notes' ELSE notes END,
+      metadata             = migration._merge_meta(metadata, v_meta),
+      updated_at           = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
+    WHERE id = p_id;
+  END IF;
+
+  PERFORM migration._set_unit('public.plg_clinical_sessions', p_id, v_unit);
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant, 'public.plg_clinical_sessions', p_id,
+      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 4. O writer do produto consumido
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_session_product(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_session    uuid;
+  v_product    uuid;
+  v_unit       uuid;
+  v_existing   uuid;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a session product needs an id');
+  END IF;
+
+  BEGIN v_session := (p_row ->> 'session_id')::uuid; EXCEPTION WHEN OTHERS THEN v_session := NULL; END;
+  BEGIN v_product := (p_row ->> 'product_id')::uuid; EXCEPTION WHEN OTHERS THEN v_product := NULL; END;
+  -- Consumo sem sess\xE3o \xE9 consumo que nenhuma tela alcan\xE7a; sem produto \xE9 uma
+  -- quantidade de nada. Os dois s\xE3o recusa de FK, e a 2\xAA passada do motor os
+  -- reapresenta depois que a sess\xE3o migrar.
+  IF v_session IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'a session product needs the session it was used in');
+  END IF;
+  IF v_product IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'a session product needs the product that was used');
+  END IF;
+
+  SELECT s.unit_id INTO v_unit FROM public.plg_clinical_sessions s
+   WHERE s.id = v_session AND s.tenant_id = p_tenant;
+
+  SELECT tenant_id INTO v_existing FROM public.plg_clinical_session_products WHERE id = p_id;
+  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
+      'reason', format('session product %s already exists in another tenant', p_id));
+  END IF;
+
+  IF v_existing IS NULL THEN
+    INSERT INTO public.plg_clinical_session_products
+      (id, tenant_id, unit_id, session_id, product_id, order_item_id, assignee_id,
+       default_quantity, used_quantity, used_unit_id, executed_on,
+       is_audited, audited_at, audit_notes, metadata, created_at, updated_at)
+    VALUES
+      (p_id, p_tenant, v_unit, v_session, v_product,
+       nullif(p_row ->> 'order_item_id', '')::uuid,
+       nullif(p_row ->> 'assignee_id', '')::uuid,
+       nullif(p_row ->> 'default_quantity', '')::numeric,
+       nullif(p_row ->> 'used_quantity', '')::numeric,
+       nullif(p_row ->> 'used_unit_id', '')::uuid,
+       nullif(p_row ->> 'executed_on', '')::date,
+       coalesce((p_row ->> 'is_audited')::boolean, false),
+       nullif(p_row ->> 'audited_at', '')::timestamptz,
+       p_row ->> 'audit_notes', v_meta,
+       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
+       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
+    v_created := true;
+  ELSE
+    UPDATE public.plg_clinical_session_products SET
+      unit_id          = coalesce(v_unit, unit_id),
+      session_id       = v_session,
+      product_id       = v_product,
+      order_item_id    = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
+      assignee_id      = coalesce(nullif(p_row ->> 'assignee_id', '')::uuid, assignee_id),
+      default_quantity = nullif(p_row ->> 'default_quantity', '')::numeric,
+      used_quantity    = nullif(p_row ->> 'used_quantity', '')::numeric,
+      used_unit_id     = coalesce(nullif(p_row ->> 'used_unit_id', '')::uuid, used_unit_id),
+      executed_on      = nullif(p_row ->> 'executed_on', '')::date,
+      is_audited       = coalesce((p_row ->> 'is_audited')::boolean, is_audited),
+      audited_at       = nullif(p_row ->> 'audited_at', '')::timestamptz,
+      audit_notes      = CASE WHEN p_row ? 'audit_notes' THEN p_row ->> 'audit_notes' ELSE audit_notes END,
+      metadata         = migration._merge_meta(metadata, v_meta),
+      updated_at       = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant, 'public.plg_clinical_session_products', p_id,
+      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 5. O writer da exig\xEAncia
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_requirement(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_kind       text  := nullif(p_row ->> 'kind', '');
+  v_scope      text  := nullif(p_row ->> 'scope', '');
+  v_status     text  := coalesce(nullif(p_row ->> 'status', ''), 'pending');
+  v_session    uuid;
+  v_unit       uuid;
+  v_subj_t     text  := nullif(p_row ->> 'subject_type', '');
+  v_cand_t     text  := nullif(p_row ->> 'candidate_type', '');
+  v_subj_id    uuid;
+  v_cand_id    uuid;
+  v_existing   uuid;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a requirement needs an id');
+  END IF;
+  IF v_kind IS NULL OR v_kind NOT IN ('form','evaluation','contract','session_term','products','invoice_item','revision_link') THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('requirement kind %L is not one of the seven the V1 writes', v_kind));
+  END IF;
+  IF v_scope IS NULL OR v_scope NOT IN ('service','attendance') THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('requirement scope %L is neither service nor attendance', v_scope));
+  END IF;
+  IF v_status NOT IN ('pending','resolved','not_applicable') THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('requirement status %L is not a status the V1 writes', v_status));
+  END IF;
+
+  BEGIN v_session := (p_row ->> 'session_id')::uuid; EXCEPTION WHEN OTHERS THEN v_session := NULL; END;
+  IF v_session IS NOT NULL THEN
+    SELECT s.unit_id INTO v_unit FROM public.plg_clinical_sessions s
+     WHERE s.id = v_session AND s.tenant_id = p_tenant;
+  END IF;
+
+  -- A refer\xEAncia polim\xF3rfica: o de-para n\xE3o alcan\xE7a, o ledger sim. Quando a
+  -- tabela apontada ainda n\xE3o atravessou o resultado \xE9 NULO \u2014 e o n\xFAmero cru
+  -- fica no metadata para a costura de depois.
+  v_subj_id := migration._clinical_resolve(p_tenant, v_subj_t, p_row ->> 'v1_resolved_ref');
+  v_cand_id := migration._clinical_resolve(p_tenant, v_cand_t, p_row ->> 'v1_candidate_ref');
+
+  SELECT tenant_id INTO v_existing FROM public.plg_clinical_requirements WHERE id = p_id;
+  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
+      'reason', format('requirement %s already exists in another tenant', p_id));
+  END IF;
+
+  IF v_existing IS NULL THEN
+    INSERT INTO public.plg_clinical_requirements
+      (id, tenant_id, unit_id, session_id, booking_id, party_id, service_id,
+       kind, scope, blocks_start, blocks_finish, status,
+       subject_type, subject_id, candidate_type, candidate_id,
+       resolved_via, resolved_at, valid_until, frozen_at, rule_sources,
+       metadata, created_at, updated_at)
+    VALUES
+      (p_id, p_tenant, v_unit, v_session,
+       nullif(p_row ->> 'booking_id', '')::uuid,
+       nullif(p_row ->> 'party_id', '')::uuid,
+       nullif(p_row ->> 'service_id', '')::uuid,
+       v_kind, v_scope,
+       coalesce((p_row ->> 'blocks_start')::boolean, false),
+       coalesce((p_row ->> 'blocks_finish')::boolean, false),
+       v_status, v_subj_t, v_subj_id, v_cand_t, v_cand_id,
+       nullif(p_row ->> 'resolved_via', ''),
+       nullif(p_row ->> 'resolved_at', '')::timestamptz,
+       nullif(p_row ->> 'valid_until', '')::timestamptz,
+       nullif(p_row ->> 'frozen_at', '')::timestamptz,
+       coalesce(p_row -> 'rule_sources', '[]'::jsonb),
+       v_meta,
+       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
+       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
+    v_created := true;
+  ELSE
+    UPDATE public.plg_clinical_requirements SET
+      unit_id        = coalesce(v_unit, unit_id),
+      session_id     = coalesce(v_session, session_id),
+      booking_id     = coalesce(nullif(p_row ->> 'booking_id', '')::uuid, booking_id),
+      party_id       = coalesce(nullif(p_row ->> 'party_id', '')::uuid, party_id),
+      service_id     = coalesce(nullif(p_row ->> 'service_id', '')::uuid, service_id),
+      kind           = v_kind,
+      scope          = v_scope,
+      blocks_start   = coalesce((p_row ->> 'blocks_start')::boolean, blocks_start),
+      blocks_finish  = coalesce((p_row ->> 'blocks_finish')::boolean, blocks_finish),
+      status         = v_status,
+      subject_type   = v_subj_t,
+      -- \`coalesce\` e n\xE3o substitui\xE7\xE3o: a segunda onda resolve o que a primeira
+      -- n\xE3o alcan\xE7ou, e nunca apaga o que j\xE1 estava resolvido.
+      subject_id     = coalesce(v_subj_id, subject_id),
+      candidate_type = v_cand_t,
+      candidate_id   = coalesce(v_cand_id, candidate_id),
+      resolved_via   = nullif(p_row ->> 'resolved_via', ''),
+      resolved_at    = nullif(p_row ->> 'resolved_at', '')::timestamptz,
+      valid_until    = nullif(p_row ->> 'valid_until', '')::timestamptz,
+      frozen_at      = nullif(p_row ->> 'frozen_at', '')::timestamptz,
+      rule_sources   = coalesce(p_row -> 'rule_sources', rule_sources),
+      metadata       = migration._merge_meta(metadata, v_meta),
+      updated_at     = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant, 'public.plg_clinical_requirements', p_id,
+      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 6. A revis\xE3o do servi\xE7o, e os formul\xE1rios dela
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_service_revision(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_service    uuid;
+  v_number     integer;
+  v_existing   uuid;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a service revision needs an id');
+  END IF;
+
+  BEGIN v_service := (p_row ->> 'service_id')::uuid; EXCEPTION WHEN OTHERS THEN v_service := NULL; END;
+  IF v_service IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'a service revision needs the service it freezes');
+  END IF;
+  v_number := greatest(coalesce(nullif(p_row ->> 'revision_number', '')::integer, 1), 1);
+
+  SELECT tenant_id INTO v_existing FROM public.plg_clinical_service_revisions WHERE id = p_id;
+  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
+      'reason', format('service revision %s already exists in another tenant', p_id));
+  END IF;
+
+  IF v_existing IS NULL THEN
+    INSERT INTO public.plg_clinical_service_revisions
+      (id, tenant_id, service_id, revision_number, price, duration_minutes, deadline_days,
+       metadata, created_at, updated_at)
+    VALUES
+      (p_id, p_tenant, v_service, v_number,
+       nullif(p_row ->> 'price', '')::numeric,
+       nullif(p_row ->> 'duration_minutes', '')::integer,
+       nullif(p_row ->> 'deadline_days', '')::integer,
+       v_meta,
+       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
+       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
+    v_created := true;
+  ELSE
+    UPDATE public.plg_clinical_service_revisions SET
+      service_id       = v_service,
+      revision_number  = v_number,
+      price            = nullif(p_row ->> 'price', '')::numeric,
+      duration_minutes = nullif(p_row ->> 'duration_minutes', '')::integer,
+      deadline_days    = nullif(p_row ->> 'deadline_days', '')::integer,
+      metadata         = migration._merge_meta(metadata, v_meta),
+      updated_at       = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant, 'public.plg_clinical_service_revisions', p_id,
+      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+-- O facet: acrescenta um formul\xE1rio ao jsonb da revis\xE3o. A chave de dedupe \xE9 o
+-- id da linha do V1, e \xE9 isso que faz a onda rodar duas vezes sem duplicar.
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_revision_form(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_rev        uuid;
+  v_ref        text := p_row ->> 'v1_ref';
+  v_entry      jsonb;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+
+  BEGIN v_rev := (p_row ->> 'revision_id')::uuid; EXCEPTION WHEN OTHERS THEN v_rev := NULL; END;
+  IF v_rev IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'a revision form needs the revision it belongs to');
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.plg_clinical_service_revisions r
+                  WHERE r.id = v_rev AND r.tenant_id = p_tenant) THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'the revision this form belongs to has not arrived yet');
+  END IF;
+
+  v_entry := jsonb_build_object(
+    'v1_ref', v_ref,
+    'v1_form_template_ref', p_row ->> 'v1_form_template_ref');
+
+  UPDATE public.plg_clinical_service_revisions
+     SET form_template_refs = (
+           SELECT coalesce(jsonb_agg(e), '[]'::jsonb)
+             FROM (SELECT e FROM jsonb_array_elements(form_template_refs) e
+                    WHERE e ->> 'v1_ref' IS DISTINCT FROM v_ref
+                   UNION ALL SELECT v_entry) s(e)),
+         updated_at = now()
+   WHERE id = v_rev;
+
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', v_rev, 'reason', 'attached');
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 7. O writer do desfecho
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE OR REPLACE FUNCTION migration.upsert_clinical_prepaid_outcome(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_outcome    text  := nullif(p_row ->> 'outcome', '');
+  v_booking    uuid;
+  v_unit       uuid;
+  v_existing   uuid;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'an outcome needs an id');
+  END IF;
+  IF v_outcome IS NULL OR v_outcome NOT IN ('contracted','declined','postponed') THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('outcome %L is not one of the three the V1 writes', v_outcome));
+  END IF;
+
+  BEGIN v_booking := (p_row ->> 'booking_id')::uuid; EXCEPTION WHEN OTHERS THEN v_booking := NULL; END;
+  IF v_booking IS NOT NULL THEN
+    SELECT a.unit_id INTO v_unit FROM public.appointments a
+     WHERE a.id = v_booking AND a.tenant_id = p_tenant;
+  END IF;
+
+  SELECT tenant_id INTO v_existing FROM public.plg_clinical_prepaid_outcomes WHERE id = p_id;
+  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
+      'reason', format('outcome %s already exists in another tenant', p_id));
+  END IF;
+
+  IF v_existing IS NULL THEN
+    INSERT INTO public.plg_clinical_prepaid_outcomes
+      (id, tenant_id, unit_id, booking_id, order_item_id, outcome, reason, decided_at, metadata, created_at, updated_at)
+    VALUES
+      (p_id, p_tenant, v_unit, v_booking,
+       nullif(p_row ->> 'order_item_id', '')::uuid,
+       v_outcome, p_row ->> 'reason',
+       coalesce(nullif(p_row ->> 'decided_at', '')::timestamptz, now()),
+       v_meta, now(), now());
+    v_created := true;
+  ELSE
+    UPDATE public.plg_clinical_prepaid_outcomes SET
+      unit_id       = coalesce(v_unit, unit_id),
+      booking_id    = coalesce(v_booking, booking_id),
+      order_item_id = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
+      outcome       = v_outcome,
+      reason        = CASE WHEN p_row ? 'reason' THEN p_row ->> 'reason' ELSE reason END,
+      decided_at    = coalesce(nullif(p_row ->> 'decided_at', '')::timestamptz, decided_at),
+      metadata      = migration._merge_meta(metadata, v_meta),
+      updated_at    = now()
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant, 'public.plg_clinical_prepaid_outcomes', p_id,
+      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 8. As seis linhas do de-para
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+SET LOCAL migration.allowlist_unlock = 'on';
+
+SELECT migration._allow(
+  'service_revisions', 'public.plg_clinical_service_revisions', 'clinical', 'clinical_service_revision',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'uuid',             'id',
+    'service_id',       'service_id@services',
+    'revision_number',  'revision_number',
+    'price',            'price',
+    'duration_minutes', 'duration_minutes',
+    'deadline_days',    'deadline_days',
+    'created_at',       'created_at',
+    'tenant_id',        '-',
+    'id',               'jsonb:clinical.v1_ref'),
+  'A vers\xE3o congelada do servi\xE7o. Vem ANTES da sess\xE3o porque \xE9 ela que d\xE1 o '
+  'pre\xE7o e o prazo que valiam no dia da contrata\xE7\xE3o.'
+);
+
+SELECT migration._allow(
+  'service_revision_forms', 'public.plg_clinical_service_revisions', 'clinical', 'clinical_revision_form',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'service_revision_id', 'revision_id@service_revisions',
+    'form_template_id',    'v1_form_template_ref',
+    'id',                  'v1_ref',
+    'uuid',                '-',
+    'service_id',          '-',
+    'created_at',          '-',
+    'tenant_id',           '-'),
+  '87 linhas em 110 revis\xF5es. N\xE3o tem tabela pr\xF3pria: entra no jsonb '
+  '\`form_template_refs\` da revis\xE3o, e o writer \xE9 um facet que dedupe pelo id do '
+  'V1 \u2014 rodar a onda duas vezes n\xE3o duplica.'
+);
+
+SELECT migration._allow(
+  'journey_executions', 'public.plg_clinical_sessions', 'clinical', 'clinical_session',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'uuid',                           'id',
+    'journey_status',                 'status',
+    'appointment_id',                 'booking_id@appointments',
+    'appointment_service_id',         'booking_item_id@appointment_services',
+    'client_id',                      'party_id@clients',
+    'professional_id',                'assignee_id@professionals',
+    'execution_professional_id',      'performed_by_id@professionals',
+    'service_id',                     'service_id@services',
+    'invoice_item_id',                'order_item_id@invoice_items',
+    'quote_item_id',                  'quote_item_id@quote_items',
+    'opportunity_id',                 'deal_id@opportunities',
+    'parent_execution_id',            'parent_session_id@journey_executions',
+    'source_evaluation_execution_id', 'source_evaluation_id@journey_executions',
+    'unit_numeric_id',                'unit_id@companies',
+    'revision_number',                'revision_number',
+    'appointment_date',               'scheduled_for',
+    'execution_start_time',           'started_at',
+    'execution_end_time',             'ended_at',
+    'products_initialized',           'products_initialized',
+    'notes',                          'notes',
+    'created_at',                     'created_at',
+    'updated_at',                     'updated_at',
+    'tenant_id',                      '-',
+    'product_id',                     '-',
+    'status',                         'jsonb:clinical.v1_status',
+    'execution_photos',               'jsonb:clinical.v1_execution_photos',
+    'id',                             'jsonb:clinical.v1_ref'),
+  'A sess\xE3o de execu\xE7\xE3o. \`journey_status\` \xE9 quem manda no estado \u2014 tem sete '
+  'palavras contra as quatro de \`status\`, e \xE9 a \xFAnica que separa or\xE7ado de '
+  'contratado; a outra fica em metadata. \`product_id\` sai: 0 de 233.950 '
+  'preenchidas. As fotos ficam em metadata at\xE9 virarem linhas de '
+  'public.documents, que \xE9 onde arquivo mora.'
+);
+
+SELECT migration._allow(
+  'execution_products', 'public.plg_clinical_session_products', 'clinical', 'clinical_session_product',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'uuid',                   'id',
+    'journey_execution_id',   'session_id@journey_executions',
+    'product_id',             'product_id@products',
+    'invoice_item_id',        'order_item_id@invoice_items',
+    'professional_id',        'assignee_id@professionals',
+    'used_unit_id',           'used_unit_id@measurement_units',
+    'unit_id',                '-',
+    'default_quantity',       'default_quantity',
+    'used_quantity',          'used_quantity',
+    'execution_date',         'executed_on',
+    'is_audited',             'is_audited',
+    'audited_at',             'audited_at',
+    'audit_notes',            'audit_notes',
+    'audited_by_user_id',     '-',
+    'created_at',             'created_at',
+    'updated_at',             'updated_at',
+    'tenant_id',              '-',
+    'stock_deducted',         '-',
+    'stock_movement_id',      '-',
+    'stock_position_id',      '-',
+    'position_allocations',   '-',
+    'unit_label_allocations', '-',
+    'consumption_photos',     'jsonb:clinical.v1_consumption_photos',
+    'id',                     'jsonb:clinical.v1_ref'),
+  'O produto consumido. As cinco colunas de baixa de estoque saem porque est\xE3o '
+  'VAZIAS: 0 de 117.015 no tenant 1. O consumo do V1 nunca chegou ao raz\xE3o \u2014 \xE9 '
+  'o que o Guia descreve na jornada auditoria-de-uso-e-estoque. A unidade vem '
+  'da sess\xE3o, no writer, e n\xE3o da coluna \`unit_id\` da origem.'
+);
+
+SELECT migration._allow(
+  'execution_requirements', 'public.plg_clinical_requirements', 'clinical', 'clinical_requirement',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'journey_execution_id', 'session_id@journey_executions',
+    'appointment_id',       'booking_id@appointments',
+    'client_id',            'party_id@clients',
+    'service_id',           'service_id@services',
+    'kind',                 'kind',
+    'scope',                'scope',
+    'status',               'status',
+    'blocks_start',         'blocks_start',
+    'blocks_finish',        'blocks_finish',
+    'resolved_table',       'subject_type',
+    'resolved_id',          'v1_resolved_ref',
+    'candidate_table',      'candidate_type',
+    'candidate_id',         'v1_candidate_ref',
+    'resolved_via',         'resolved_via',
+    'resolved_at',          'resolved_at',
+    'valid_until',          'valid_until',
+    'frozen_at',            'frozen_at',
+    'rule_sources',         'rule_sources',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'ref_id',               'jsonb:clinical.v1_ref_id',
+    'id',                   'jsonb:clinical.v1_ref'),
+  'O que trava come\xE7ar e terminar. Sem \`uuid\` na origem \u2014 o id do destino nasce '
+  'determin\xEDstico da chave num\xE9rica. \`resolved_table\`/\`resolved_id\` \xE9 refer\xEAncia '
+  'polim\xF3rfica e o \`@tabela\` do de-para \xE9 est\xE1tico, ent\xE3o quem resolve \xE9 o '
+  'writer, lendo o ledger com o nome que chegou na linha.'
+);
+
+SELECT migration._allow(
+  'prepaid_item_outcomes', 'public.plg_clinical_prepaid_outcomes', 'clinical', 'clinical_prepaid_outcome',
+  '{}'::jsonb, NULL::text[],
+  jsonb_build_object(
+    'appointment_id',   'booking_id@appointments',
+    'invoice_item_id',  'order_item_id@invoice_items',
+    'outcome',          'outcome',
+    'reason',           'reason',
+    'decided_at',       'decided_at',
+    'decided_by',       '-',
+    'tenant_id',        '-',
+    'id',               'jsonb:clinical.v1_ref'),
+  'O desfecho do servi\xE7o contratado e n\xE3o executado no dia. \`decided_by\` \xE9 '
+  'usu\xE1rio do auth do V1, que n\xE3o atravessa \u2014 fica de fora em vez de virar uma '
+  'FK que aponta para nada.'
+);
+
+RESET migration.allowlist_unlock;
+
+REVOKE ALL ON FUNCTION migration._clinical_resolve(uuid, text, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION migration._clinical_resolve(uuid, text, text) TO service_role;
+DO $$
+DECLARE f text;
+BEGIN
+  FOREACH f IN ARRAY ARRAY['upsert_clinical_session', 'upsert_clinical_session_product',
+                           'upsert_clinical_requirement', 'upsert_clinical_service_revision',
+                           'upsert_clinical_revision_form', 'upsert_clinical_prepaid_outcome'] LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION migration.%I(uuid, uuid, jsonb, jsonb) FROM PUBLIC, anon, authenticated', f);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION migration.%I(uuid, uuid, jsonb, jsonb) TO service_role', f);
+  END LOOP;
+END $$;
+`;
+var MIGRATION_003_A_PERMISSAO_SE_PERGUNTA_POR_UNIDADE_NAO_POR_LINHA = `-- A permiss\xE3o se pergunta por unidade, n\xE3o por linha.
+--
+-- A tela \`Estoque \u2192 Auditoria de uso\` estourava o \`statement_timeout\`. Medido
+-- no cluster, como \`authenticated\`, tenant Espa\xE7o Facial:
+--
+--     select * from v_inventory_usage_audit order by used_at desc limit 50
+--       \u2192 97.143 ms
+--
+-- A vista n\xE3o era a culpada. As duas tabelas que ela l\xEA j\xE1 eram lentas sozinhas:
+--
+--     select count(*) from plg_clinical_session_products   19.000 ms
+--     select count(*) from plg_clinical_sessions           22.500 ms
+--
+-- \u2500\u2500 A linha que custava \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A pol\xEDtica que a 001 escreveu chama \`app.has_permission('clinical.read',
+-- unit_id)\` \u2014 e \`unit_id\` \xE9 COLUNA, ent\xE3o a chamada \xE9 por LINHA. S\xE3o 116.911
+-- produtos consumidos e 233.556 sess\xF5es; o Espa\xE7o Facial tem 67 unidades.
+--
+-- \xC9 a mesma forma do defeito que o spine 121 corrigiu em \`people\`, e a mesma
+-- corre\xE7\xE3o: a pergunta n\xE3o muda dentro da unidade, ent\xE3o ela se faz uma vez
+-- POR UNIDADE. \`unit_id IN (subconsulta n\xE3o correlacionada)\` \xE9 resolvido pelo
+-- planejador como hash montado uma vez; a subconsulta percorre \`app.units\` do
+-- inquilino e aplica ali os dois predicados que antes rodavam por linha.
+--
+-- A reescrita \xE9 EQUIVALENTE por constru\xE7\xE3o, n\xE3o por argumento: s\xE3o os mesmos
+-- dois predicados (\`app.has_unit\` e \`app.has_permission\`) sobre os mesmos
+-- valores de \`unit_id\`, s\xF3 que avaliados uma vez por valor distinto em vez de
+-- uma vez por linha. A linha sem unidade continua decidida pela permiss\xE3o de
+-- inquilino, como antes.
+--
+-- Medido depois, com ROLLBACK, antes de escrever este arquivo:
+--
+--     plg_clinical_session_products   116.911 linhas     450 ms   (era 19.000)
+--     plg_clinical_sessions           233.556 linhas   1.070 ms   (era 22.500)
+--     auditoria de uso, 50 linhas          50 linhas   1.330 ms   (era 97.143)
+--
+-- As contagens s\xE3o ID\xCANTICAS \xE0s de antes \u2014 \xE9 o teste que importa numa mudan\xE7a
+-- de pol\xEDtica, porque uma que fica r\xE1pida devolvendo menos linhas n\xE3o ficou
+-- r\xE1pida, ficou errada.
+--
+-- Idempotente.
+
+DO $$
+DECLARE
+  t text;
+  v_unidade text := $q$unit_id IN (SELECT u.id FROM app.units u
+                     WHERE u.tenant_id = (SELECT app.current_tenant_id())
+                       AND app.has_unit(u.id)
+                       AND app.has_permission('clinical.read', u.id))$q$;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
+                           'plg_clinical_requirements', 'plg_clinical_prepaid_outcomes'] LOOP
+    IF to_regclass('public.' || t) IS NULL THEN CONTINUE; END IF;
+    EXECUTE format($f$ALTER POLICY %I ON public.%I USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (CASE WHEN unit_id IS NULL
+                  THEN (SELECT app.has_permission('clinical.read', NULL::uuid))
+                  ELSE %s END))$f$, t || '_authz_select', t, v_unidade);
+  END LOOP;
+END $$;
+
+-- \`plg_clinical_service_revisions\` fica como est\xE1: ela n\xE3o tem unidade \u2014 a
+-- revis\xE3o \xE9 do CAT\xC1LOGO, e o pre\xE7o congelado de um servi\xE7o vale na rede
+-- inteira. A pol\xEDtica dela j\xE1 decide uma vez por consulta.
+
+-- A auditoria de uso ordena por data e corta em 50. Sem \xEDndice, isso \xE9 ordenar
+-- 116.911 linhas para jogar 116.861 fora.
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_executed_idx
+  ON public.plg_clinical_session_products USING btree (tenant_id, executed_on DESC);
+`;
+var MIGRATION_004_A_REGUA_VOLTA_A_SER_APURADA = `-- ============================================================================
+-- A r\xE9gua do atendimento volta a ser APURADA
+--
+-- SINTOMA: 6.236 linhas de exig\xEAncia atravessaram do V1 e est\xE3o congeladas.
+-- Nada no V2 as recalcula: um atendimento novo nasce sem r\xE9gua, e um antigo
+-- nunca responde de novo "o que este servi\xE7o exigia". A r\xE9gua migrada \xE9 foto,
+-- n\xE3o motor.
+--
+-- O V1 resolve isso em duas fun\xE7\xF5es (\`materialize_execution_requirements\` e
+-- \`refresh_execution_requirements\`, migration 20260927130000). Esta migration \xE9
+-- o espelho delas sobre o modelo do V2, com tr\xEAs diferen\xE7as declaradas:
+--
+--   1. CONTRATO E TERMO DE SESS\xC3O FICAM DE FORA. Os blocos d, e, f do V1
+--      dependem de \`contract_templates\` e \`generated_contracts\`, que o V2 n\xE3o
+--      modela. Emitir uma bola de contrato que nada pode resolver deixaria todo
+--      atendimento eternamente pendente \u2014 indicador errado \xE9 pior que nenhum.
+--   2. O QUE A EXIG\xCANCIA PEDE ganha colunas. O V1 tem \`ref_id\` (o modelo de
+--      formul\xE1rio exigido); o ETL despejou isso em \`metadata.clinical.v1_ref_id\`
+--      e a tabela ficou sem discriminador \u2014 por isso h\xE1 1.378 grupos
+--      (session, kind) repetidos, que s\xE3o formul\xE1rios diferentes indistingu\xEDveis.
+--      \`ref_type\`/\`ref_id\` devolvem a pergunta; a chave \xFAnica cobre s\xF3 as linhas
+--      que este motor escreve, porque as migradas n\xE3o t\xEAm como ser desempatadas
+--      enquanto os modelos de formul\xE1rio n\xE3o chegarem.
+--   3. DUAS BANDEIRAS DE SERVI\xC7O n\xE3o vieram do V1 (\`requires_evaluation\` e
+--      \`always_ask_used_products\`). Sem elas os blocos g e i ficariam mudos,
+--      ent\xE3o entram em \`products\` \u2014 onde o servi\xE7o mora no V2.
+--
+-- Modo: \`off\` (nada acontece) \xB7 \`shadow\` (grava e n\xE3o muda tela) \xB7 \`on\`.
+-- L\xEA-se de \`tenants.settings -> 'execution_requirements' ->> 'mode'\`.
+-- ============================================================================
+
+-- \u2500\u2500\u2500 0. O que faltava para a pergunta caber \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.products
+  ADD COLUMN IF NOT EXISTS requires_evaluation boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS always_ask_used_products boolean NOT NULL DEFAULT false;
+
+COMMENT ON COLUMN public.products.requires_evaluation IS
+  'Servi\xE7o que s\xF3 se executa depois de uma avalia\xE7\xE3o vinculada (bloco g da r\xE9gua).';
+COMMENT ON COLUMN public.products.always_ask_used_products IS
+  'Servi\xE7o que sempre pergunta os produtos usados, mesmo sem ficha t\xE9cnica (bloco i).';
+
+ALTER TABLE public.plg_clinical_requirements
+  ADD COLUMN IF NOT EXISTS ref_type text,
+  ADD COLUMN IF NOT EXISTS ref_id uuid;
+
+COMMENT ON COLUMN public.plg_clinical_requirements.ref_type IS
+  'O que a exig\xEAncia PEDE (form_template). N\xE3o confundir com subject_*, que \xE9 o que a RESOLVEU.';
+
+-- Chave \xFAnica s\xF3 das linhas deste motor: as migradas perderam o discriminador
+-- (ver cabe\xE7alho) e colidiriam entre si.
+CREATE UNIQUE INDEX IF NOT EXISTS plg_clinical_requirements_engine_key
+  ON public.plg_clinical_requirements (session_id, kind, (coalesce(ref_id, '00000000-0000-0000-0000-000000000000'::uuid)))
+  WHERE metadata -> 'migration' IS NULL;
+
+CREATE INDEX IF NOT EXISTS plg_clinical_requirements_booking_status
+  ON public.plg_clinical_requirements (booking_id, status);
+
+-- \u2500\u2500\u2500 1. O modo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE OR REPLACE FUNCTION public.clinical_requirements_mode(p_tenant uuid)
+RETURNS text LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public'
+AS $fn$
+  SELECT CASE lower(coalesce(t.settings -> 'execution_requirements' ->> 'mode', 'off'))
+           WHEN 'shadow' THEN 'shadow'
+           WHEN 'on' THEN 'on'
+           ELSE 'off'
+         END
+  FROM public.tenants t WHERE t.id = p_tenant;
+$fn$;
+
+-- \u2500\u2500\u2500 2. Uma linha, idempotente (o OR dos bloqueios \xE9 do V1) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE OR REPLACE FUNCTION public.clinical_requirement_upsert(
+  p_tenant uuid, p_unit uuid, p_booking uuid, p_session uuid, p_party uuid, p_service uuid,
+  p_kind text, p_scope text, p_ref_type text, p_ref_id uuid, p_rule text,
+  p_blocks_start boolean, p_blocks_finish boolean)
+RETURNS integer LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
+AS $fn$
+DECLARE v_id uuid;
+BEGIN
+  SELECT r.id INTO v_id FROM public.plg_clinical_requirements r
+   WHERE r.session_id = p_session AND r.kind = p_kind
+     AND coalesce(r.ref_id, '00000000-0000-0000-0000-000000000000'::uuid)
+       = coalesce(p_ref_id, '00000000-0000-0000-0000-000000000000'::uuid)
+     AND r.metadata -> 'migration' IS NULL;
+
+  IF v_id IS NULL THEN
+    INSERT INTO public.plg_clinical_requirements (
+      tenant_id, unit_id, booking_id, session_id, party_id, service_id,
+      kind, scope, ref_type, ref_id, rule_sources, blocks_start, blocks_finish, status)
+    VALUES (p_tenant, p_unit, p_booking, p_session, p_party, p_service,
+      p_kind, p_scope, p_ref_type, p_ref_id, jsonb_build_array(p_rule),
+      coalesce(p_blocks_start, false), coalesce(p_blocks_finish, false), 'pending');
+    RETURN 1;
+  END IF;
+
+  -- J\xE1 existe: soma a origem da regra e faz o OR dos bloqueios. Uma linha
+  -- resolvida ou congelada n\xE3o volta a pendente por aqui.
+  UPDATE public.plg_clinical_requirements r
+     SET rule_sources = CASE WHEN r.rule_sources @> to_jsonb(p_rule) THEN r.rule_sources
+                             ELSE r.rule_sources || to_jsonb(p_rule) END,
+         blocks_start = r.blocks_start OR coalesce(p_blocks_start, false),
+         blocks_finish = r.blocks_finish OR coalesce(p_blocks_finish, false),
+         status = CASE WHEN r.status = 'not_applicable' THEN 'pending' ELSE r.status END,
+         updated_at = now()
+   WHERE r.id = v_id AND r.frozen_at IS NULL;
+  RETURN 0;
+END $fn$;
+
+-- \u2500\u2500\u2500 3. Materializar as linhas em branco de UMA sess\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE OR REPLACE FUNCTION public.clinical_requirements_materialize(p_session uuid)
+RETURNS integer LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
+AS $fn$
+DECLARE
+  s record; sv record; r record; cfg jsonb;
+  v_mode text; v_n int := 0; v_booking_status text; v_rule text;
+  v_is_revision boolean; v_has_parent boolean; v_rev_num int; v_kind text;
+BEGIN
+  SELECT * INTO s FROM public.plg_clinical_sessions WHERE id = p_session;
+  IF NOT FOUND OR s.booking_id IS NULL THEN RETURN 0; END IF;
+
+  v_mode := public.clinical_requirements_mode(s.tenant_id);
+  IF v_mode = 'off' THEN RETURN 0; END IF;
+
+  SELECT a.status INTO v_booking_status FROM public.appointments a WHERE a.id = s.booking_id;
+  -- Hist\xF3rico n\xE3o ganha linha: sess\xE3o j\xE1 executada em atendimento que n\xE3o est\xE1
+  -- em curso \xE9 fato consumado (mesma regra do V1).
+  IF s.status IN ('executed', 'invoiced') AND coalesce(v_booking_status, '') <> 'in_progress' THEN
+    RETURN 0;
+  END IF;
+
+  BEGIN
+    SELECT p.service_kind, p.requires_evaluation, p.always_ask_used_products, p.category_id
+      INTO sv FROM public.products p WHERE p.id = s.service_id;
+    IF NOT FOUND THEN RETURN 0; END IF;
+    v_kind := coalesce(sv.service_kind, 'standard');
+
+    -- QUEM \xC9 REVIS\xC3O. O V1 tem um booleano (\`is_revision\`) ao lado do n\xFAmero.
+    -- No V2 sobrou s\xF3 o n\xFAmero \u2014 e o ETL gravou \`revision_number = 1\` em TODA
+    -- sess\xE3o, ent\xE3o o n\xFAmero n\xE3o distingue nada: lido como "\xE9 revis\xE3o", ele
+    -- transformou 54 de 54 sess\xF5es em revis\xE3o, tirou o item de fatura de 21
+    -- delas e inventou v\xEDnculo de revis\xE3o em 43. O que de fato separa as duas
+    -- coisas no V2 \xE9 o PAI: revis\xE3o aponta para a sess\xE3o original. Conferido
+    -- contra as 288 exig\xEAncias migradas destes mesmos atendimentos: o V1
+    -- gravou \`invoice_item\` exatamente nas 21 sess\xF5es \`standard\` sem pai, e
+    -- \`revision_link\` exatamente nas 8 de \`return\` mais as 3 \`standard\` com pai.
+    v_rev_num := coalesce(s.revision_number, 0);
+    v_has_parent := s.parent_session_id IS NOT NULL;
+    v_is_revision := v_has_parent OR v_kind = 'return';
+
+    cfg := coalesce((SELECT t.settings -> 'evaluation_flow' FROM public.tenants t WHERE t.id = s.tenant_id), '{}'::jsonb);
+    IF jsonb_typeof(cfg) <> 'object' THEN cfg := '{}'::jsonb; END IF;
+
+    -- a) Formul\xE1rios universais do tenant \u2014 escopo atendimento.
+    FOR r IN SELECT ft.id FROM public.plg_forms_templates ft
+              WHERE ft.tenant_id = s.tenant_id AND ft.is_active AND coalesce(ft.is_deleted, false) = false
+                AND coalesce(ft.required_on_attendance, false)
+    LOOP
+      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+               s.party_id, s.service_id, 'form', 'attendance', 'form_template', r.id,
+               'forms_templates.required_on_attendance', false, false);
+    END LOOP;
+
+    IF NOT v_has_parent THEN
+      -- b) Formul\xE1rios do servi\xE7o.
+      FOR r IN SELECT sd.template_id, coalesce(sd.requirement_scope, 'attendance') AS scope
+                 FROM public.plg_forms_service_defaults sd
+                 JOIN public.plg_forms_templates ft ON ft.id = sd.template_id AND ft.is_active
+                WHERE sd.product_id = s.service_id AND sd.tenant_id = s.tenant_id
+      LOOP
+        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+                 s.party_id, s.service_id, 'form',
+                 CASE WHEN r.scope = 'service' THEN 'service' ELSE 'attendance' END,
+                 'form_template', r.template_id, 'forms_service_defaults', false, false);
+      END LOOP;
+    ELSE
+      -- c) Formul\xE1rios da revis\xE3o, pelo n\xFAmero dela. No V2 os modelos da revis\xE3o
+      --    moram numa lista dentro da pr\xF3pria revis\xE3o.
+      FOR r IN SELECT (e.value #>> '{}')::uuid AS template_id
+                 FROM public.plg_clinical_service_revisions rev,
+                      LATERAL jsonb_array_elements(coalesce(rev.form_template_refs, '[]'::jsonb)) e
+                WHERE rev.tenant_id = s.tenant_id AND rev.service_id = s.service_id
+                  AND rev.revision_number = v_rev_num
+                  AND (e.value #>> '{}') ~ '^[0-9a-f-]{36}$'
+      LOOP
+        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+                 s.party_id, s.service_id, 'form', 'service', 'form_template', r.template_id,
+                 'clinical_service_revisions.form_template_refs', false, false);
+      END LOOP;
+    END IF;
+
+    -- d, e, f) CONTRATO e TERMO DE SESS\xC3O: fora, por falta de modelo no V2.
+    --          Ver o cabe\xE7alho desta migration.
+
+    -- g) Avalia\xE7\xE3o vinculada.
+    IF v_kind = 'standard' THEN
+      IF coalesce(sv.requires_evaluation, false) THEN
+        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+                 s.party_id, s.service_id, 'evaluation', 'service', NULL, NULL,
+                 'products.requires_evaluation', false, false);
+      ELSIF coalesce((cfg ->> 'require_evaluation_for_kind_service')::boolean, false) THEN
+        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+                 s.party_id, s.service_id, 'evaluation', 'service', NULL, NULL,
+                 'evaluation_flow.require_evaluation_for_kind_service', false, false);
+      END IF;
+    END IF;
+
+    -- h) Revis\xE3o vinculada ao servi\xE7o original: trava come\xE7ar E terminar.
+    IF v_is_revision AND coalesce((cfg ->> 'revision_link_required')::boolean, false) THEN
+      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+               s.party_id, s.service_id, 'revision_link', 'service', NULL, NULL,
+               'evaluation_flow.revision_link_required', true, true);
+    END IF;
+
+    -- i) Produtos utilizados: ficha t\xE9cnica, "sempre perguntar", ou j\xE1 lan\xE7ado.
+    v_rule := NULL;
+    IF EXISTS (SELECT 1 FROM public.plg_inventory_recipes rc
+                WHERE rc.product_id = s.service_id AND rc.tenant_id = s.tenant_id
+                  AND coalesce(rc.is_active, true)) THEN
+      v_rule := 'inventory_recipes';
+    ELSIF coalesce(sv.always_ask_used_products, false) THEN
+      v_rule := 'products.always_ask_used_products';
+    ELSIF EXISTS (SELECT 1 FROM public.plg_clinical_session_products sp
+                   WHERE sp.session_id = s.id
+                      OR (s.order_item_id IS NOT NULL AND sp.order_item_id = s.order_item_id)) THEN
+      v_rule := 'clinical_session_products';
+    END IF;
+    IF v_rule IS NOT NULL THEN
+      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+               s.party_id, s.service_id, 'products', 'service', NULL, NULL, v_rule, false, false);
+    END IF;
+
+    -- j) Item de fatura: servi\xE7o comum, n\xE3o-revis\xE3o.
+    IF v_kind = 'standard' AND NOT v_has_parent THEN
+      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
+               s.party_id, s.service_id, 'invoice_item', 'service', NULL, NULL, 'billing', false, false);
+    END IF;
+  EXCEPTION WHEN others THEN
+    -- Nunca derruba quem chama: a fonte (a sess\xE3o) n\xE3o pode falhar por causa da r\xE9gua.
+    RAISE WARNING 'clinical_requirements_materialize(%): %', p_session, sqlerrm;
+    RETURN 0;
+  END;
+  RETURN v_n;
+END $fn$;
+
+-- \u2500\u2500\u2500 4. Reapurar as linhas de UM atendimento \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE OR REPLACE FUNCTION public.clinical_requirements_refresh(p_booking uuid, p_final boolean DEFAULT false)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
+AS $fn$
+DECLARE
+  a record; v_mode text; v_now timestamptz := now(); v_eval jsonb;
+  n_mat int := 0; n_reopen int := 0;
+  -- \`v_sessao\`, n\xE3o \`r\`: plpgsql resolve o nome da VARI\xC1VEL antes do apelido da
+  -- tabela, ent\xE3o um \`record r\` declarado aqui sequestra todo \`r.coluna\` dos
+  -- UPDATEs abaixo \u2014 e o erro que sai \xE9 "record r has no field booking_id".
+  v_sessao record;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.party_id, ap.status INTO a
+    FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_mode := public.clinical_requirements_mode(a.tenant_id);
+  IF v_mode = 'off' THEN RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'skipped', true); END IF;
+
+  p_final := coalesce(p_final, false) AND a.status = 'completed';
+
+  BEGIN
+    PERFORM pg_advisory_xact_lock(hashtextextended('clinical_req:' || p_booking::text, 0));
+    IF a.status = 'completed' AND NOT p_final THEN
+      RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'frozen', true);
+    END IF;
+
+    -- 1) Materializa o que falta (sess\xE3o nova, ficha t\xE9cnica criada depois).
+    FOR v_sessao IN SELECT cs.id FROM public.plg_clinical_sessions cs WHERE cs.booking_id = p_booking
+    LOOP
+      n_mat := n_mat + public.clinical_requirements_materialize(v_sessao.id);
+    END LOOP;
+
+    v_eval := coalesce((SELECT t.settings -> 'evaluation_flow' FROM public.tenants t WHERE t.id = a.tenant_id), '{}'::jsonb);
+    IF jsonb_typeof(v_eval) <> 'object' THEN v_eval := '{}'::jsonb; END IF;
+
+    -- 1b) Regra que saiu da configura\xE7\xE3o para de bloquear (o upsert reabre se voltar).
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'not_applicable', candidate_type = NULL, candidate_id = NULL, updated_at = v_now
+     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.frozen_at IS NULL
+       AND r.metadata -> 'migration' IS NULL
+       AND ((r.kind = 'revision_link' AND NOT coalesce((v_eval ->> 'revision_link_required')::boolean, false))
+         OR (r.kind = 'evaluation'
+             AND r.rule_sources = '["evaluation_flow.require_evaluation_for_kind_service"]'::jsonb
+             AND NOT coalesce((v_eval ->> 'require_evaluation_for_kind_service')::boolean, false)));
+
+    -- 2) Reabre o que perdeu a fonte. Linha congelada n\xE3o se mexe.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'pending', subject_type = NULL, subject_id = NULL, resolved_via = NULL,
+           resolved_at = NULL, valid_until = NULL, updated_at = v_now
+     WHERE r.booking_id = p_booking AND r.status = 'resolved' AND r.frozen_at IS NULL
+       AND ((r.subject_type = 'documents' AND NOT EXISTS (SELECT 1 FROM public.documents d WHERE d.id = r.subject_id))
+         OR (r.subject_type = 'clinical_sessions' AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions x WHERE x.id = r.subject_id))
+         OR (r.subject_type = 'items' AND NOT EXISTS (SELECT 1 FROM public.items oi WHERE oi.id = r.subject_id)));
+    GET DIAGNOSTICS n_reopen = ROW_COUNT;
+
+    -- 3) Formul\xE1rio universal: a \xFAltima resposta do cliente, em qualquer
+    --    atendimento, ainda dentro da validade do modelo.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
+           resolved_via = CASE WHEN x.subject_id = p_booking THEN 'attendance' ELSE 'auto_client' END,
+           resolved_at = v_now,
+           valid_until = CASE WHEN x.validity_days IS NULL THEN NULL
+                              ELSE x.eff + make_interval(days => x.validity_days) END,
+           updated_at = v_now
+      FROM (SELECT DISTINCT ON (fd.template_id) d.id, fd.template_id, d.subject_id,
+                   coalesce(d.updated_at, d.created_at) AS eff, ft.validity_days
+              FROM public.plg_forms_documents fd
+              JOIN public.documents d ON d.id = fd.document_id
+              JOIN public.plg_forms_templates ft ON ft.id = fd.template_id
+             WHERE d.person_id = a.party_id AND d.tenant_id = a.tenant_id
+             ORDER BY fd.template_id, coalesce(d.updated_at, d.created_at) DESC) x
+     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
+       AND r.scope = 'attendance' AND r.ref_id = x.template_id
+       AND r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb
+       AND (x.validity_days IS NULL OR x.eff + make_interval(days => x.validity_days) > v_now);
+
+    -- 4) Demais formul\xE1rios: qualquer resposta DESTE atendimento com o modelo.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
+           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
+      FROM (SELECT DISTINCT ON (fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid))
+                   d.id, fd.template_id, fd.product_id
+              FROM public.plg_forms_documents fd
+              JOIN public.documents d ON d.id = fd.document_id
+             WHERE d.subject_type = 'appointment' AND d.subject_id = p_booking
+             ORDER BY fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid),
+                      coalesce(d.updated_at, d.created_at) DESC) x
+     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
+       AND r.ref_id = x.template_id
+       AND NOT (r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb)
+       AND (x.product_id IS NULL OR r.scope = 'attendance' OR x.product_id = r.service_id);
+
+    -- 5) Avalia\xE7\xE3o vinculada: a sess\xE3o aponta a avalia\xE7\xE3o que a autorizou.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = x.eval_id,
+           resolved_via = CASE WHEN x.same_booking THEN 'attendance' ELSE 'auto_client' END,
+           resolved_at = v_now, updated_at = v_now
+      FROM (SELECT r2.id AS req_id, e.id AS eval_id, (e.booking_id = p_booking) AS same_booking
+              FROM public.plg_clinical_requirements r2
+              JOIN public.plg_clinical_sessions cs ON cs.id = r2.session_id
+              JOIN public.plg_clinical_sessions e ON e.id = cs.source_evaluation_id
+             WHERE r2.booking_id = p_booking AND r2.kind = 'evaluation' AND r2.frozen_at IS NULL
+               AND (r2.status = 'pending' OR (r2.status = 'resolved' AND r2.resolved_via = 'legacy_grace'))) x
+     WHERE r.id = x.req_id;
+
+    -- 5b) Gra\xE7a legada: o cliente j\xE1 tem atendimento conclu\xEDdo com servi\xE7o de
+    --     avalia\xE7\xE3o. \xC9 a mesma concess\xE3o do V1, e vai marcada como tal.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'appointments', subject_id = x.booking_id,
+           resolved_via = 'legacy_grace', resolved_at = v_now, updated_at = v_now
+      FROM (SELECT ap.id AS booking_id
+              FROM public.appointments ap
+              JOIN public.appointment_items ai ON ai.booking_id = ap.id
+              JOIN public.products p ON p.id = ai.service_id AND p.service_kind = 'evaluation'
+             WHERE ap.party_id = a.party_id AND ap.tenant_id = a.tenant_id AND ap.status = 'completed'
+             ORDER BY ap.starts_at DESC NULLS LAST LIMIT 1) x
+     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'evaluation';
+
+    -- 6) Revis\xE3o vinculada ao servi\xE7o original.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.parent_session_id,
+           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
+      FROM public.plg_clinical_sessions cs
+     WHERE cs.id = r.session_id AND r.booking_id = p_booking
+       AND r.status = 'pending' AND r.kind = 'revision_link'
+       AND cs.parent_session_id IS NOT NULL
+       AND EXISTS (SELECT 1 FROM public.plg_clinical_sessions p WHERE p.id = cs.parent_session_id);
+
+    -- 7) Produtos: a sess\xE3o declara que foram conferidos.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.id,
+           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
+      FROM public.plg_clinical_sessions cs
+     WHERE cs.id = r.session_id AND r.booking_id = p_booking
+       AND r.status = 'pending' AND r.kind = 'products'
+       AND coalesce(cs.products_initialized, false);
+
+    -- 8) Item de pedido vinculado. A linha do pedido no V2 \xE9 \`public.items\` \u2014
+    --    n\xE3o existe \`order_items\`; o pedido \xE9 o documento e o item \xE9 dele.
+    UPDATE public.plg_clinical_requirements r
+       SET status = 'resolved', subject_type = 'items', subject_id = oi.id,
+           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
+      FROM public.plg_clinical_sessions cs
+      JOIN public.items oi ON oi.id = cs.order_item_id
+     WHERE cs.id = r.session_id AND r.booking_id = p_booking
+       AND r.status = 'pending' AND r.kind = 'invoice_item';
+
+    -- 9) Congelamento: s\xF3 na \xFAltima passada, com o atendimento conclu\xEDdo.
+    IF p_final THEN
+      UPDATE public.plg_clinical_requirements
+         SET frozen_at = coalesce(frozen_at, v_now), updated_at = v_now
+       WHERE booking_id = p_booking;
+    END IF;
+
+    RETURN jsonb_build_object(
+      'ok', true, 'mode', v_mode, 'materialized', n_mat, 'reopened', n_reopen,
+      'pending', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'pending'),
+      'resolved', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'resolved'),
+      'frozen', p_final);
+  EXCEPTION WHEN others THEN
+    RAISE WARNING 'clinical_requirements_refresh(%): %', p_booking, sqlerrm;
+    RETURN jsonb_build_object('ok', false, 'error', sqlerrm);
+  END;
+END $fn$;
+
+-- \u2500\u2500\u2500 5. Quem pode chamar \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Escrita s\xF3 pelas fun\xE7\xF5es (definer). O app chama o refresh; o resto \xE9 interno.
+
+REVOKE ALL ON FUNCTION public.clinical_requirement_upsert(uuid, uuid, uuid, uuid, uuid, uuid, text, text, text, uuid, text, boolean, boolean) FROM public, anon, authenticated;
+REVOKE ALL ON FUNCTION public.clinical_requirements_materialize(uuid) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.clinical_requirements_mode(uuid) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.clinical_requirements_refresh(uuid, boolean) TO authenticated;
+`;
+var MIGRATION_005_COMECAR_O_ATENDIMENTO_E_UM_GESTO_SO = `-- ============================================================================
+-- Come\xE7ar o atendimento \xE9 UM gesto \u2014 e uma transa\xE7\xE3o s\xF3
+--
+-- No V1, "Iniciar Atendimento" grava tr\xEAs coisas no mesmo instante: o
+-- agendamento vira \`in_progress\`, a execu\xE7\xE3o de cada servi\xE7o nasce, e a r\xE9gua \xE9
+-- materializada (\`rpc/refresh_execution_requirements\`). Se qualquer uma falhar
+-- sozinha o atendimento fica meio aberto: status trocado sem r\xE9gua, ou r\xE9gua
+-- sem sess\xE3o \u2014 e a tela mostra uma bola que n\xE3o pertence a nada.
+--
+-- Por isso \xE9 uma fun\xE7\xE3o e n\xE3o tr\xEAs chamadas do app. A recep\xE7\xE3o e o profissional
+-- podem apertar o bot\xE3o ao mesmo tempo, e o segundo n\xE3o pode duplicar sess\xE3o.
+--
+-- QUEM PODE: o V1 s\xF3 monta a r\xE9gua para quem est\xE1 VINCULADO A UM PROFISSIONAL,
+-- e s\xF3 enxerga o atendimento DELE com aquele cliente. Aqui a regra \xE9 a mesma \u2014
+-- e a recusa \xE9 FALADA (\`reason\`), n\xE3o silenciosa: a tela precisa dizer por que
+-- o bot\xE3o n\xE3o serve, em vez de sumir com ele.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_created int := 0; v_item record; v_refresh jsonb;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.starts_at
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
+  END IF;
+
+  -- A pessoa por tr\xE1s do login. Nulo = login sem ficha (o dono que criou o
+  -- espa\xE7o, a licen\xE7a de suporte): v\xEA tudo, atende ningu\xE9m.
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
+  END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  -- Atender o que n\xE3o \xE9 de hoje abriria um atendimento paralelo ao agendado \u2014
+  -- o mesmo motivo que fez o V1 trocar o bot\xE3o conforme o dia.
+  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
+  END IF;
+  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
+  END IF;
+
+  -- Uma sess\xE3o por servi\xE7o do agendamento. \`booking_item_id\` \xE9 a chave de
+  -- idempot\xEAncia: apertar duas vezes (ou duas pessoas ao mesmo tempo) n\xE3o
+  -- duplica nada.
+  FOR v_item IN
+    SELECT ai.id, ai.service_id, ai.assignee_id
+      FROM public.appointment_items ai
+     WHERE ai.booking_id = p_booking
+  LOOP
+    INSERT INTO public.plg_clinical_sessions (
+      tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
+      assignee_id, performed_by_id, service_id, scheduled_for, started_at)
+    SELECT a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
+           coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
+           a.starts_at, now()
+     WHERE NOT EXISTS (
+       SELECT 1 FROM public.plg_clinical_sessions cs
+        WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
+    IF FOUND THEN v_created := v_created + 1; END IF;
+  END LOOP;
+
+  UPDATE public.appointments
+     SET status = 'in_progress', updated_at = now()
+   WHERE id = p_booking AND status <> 'in_progress';
+
+  v_refresh := public.clinical_requirements_refresh(p_booking);
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'sessoes_criadas', v_created,
+    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
+    'regua', v_refresh);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
+`;
+var MIGRATION_006_CONTRATAR_NAO_E_PAGAR = `-- ============================================================================
+-- CONTRATAR n\xE3o \xE9 PAGAR
+--
+-- O passo mais delicado do turno do injetor, e a demonstra\xE7\xE3o do V1 para nele
+-- para explicar: *"Mas at\xE9 ent\xE3o ele n\xE3o pagou ainda? N\xE3o pagou \u2014 mas ele vai
+-- executar."* Contratar cria a D\xCDVIDA; receber \xE9 papel da recep\xE7\xE3o, em outra
+-- tela e outro momento.
+--
+-- No V1 isto grava \`generated_contracts\` + \`invoices\` + \`invoice_items\`. No V2
+-- o documento \xE9 o PEDIDO, e h\xE1 uma porta s\xF3 para abri-lo: \`order_create\` \u2014 a
+-- mesma que o PDV, o totem e a agenda usam. Nada aqui escreve uma linha de
+-- fatura \xE0 m\xE3o; a cobran\xE7a nasce depois, quando o atendimento fecha.
+--
+-- Por que uma fun\xE7\xE3o e n\xE3o tr\xEAs chamadas do app: contratar \xE9 abrir o pedido,
+-- ligar cada sess\xE3o \xE0 sua linha e reapurar a r\xE9gua. Pedido aberto com a sess\xE3o
+-- solta \xE9 um atendimento que cobra e n\xE3o sabe o que executou.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_contract_services(p_booking uuid, p_lines jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_order uuid; v_line jsonb; v_item uuid; v_n int := 0;
+  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_marcado');
+  END IF;
+
+  -- As linhas, no formato que \`order_create\` j\xE1 entende.
+  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+  LOOP
+    v_rpc_lines := v_rpc_lines || jsonb_build_object(
+      'product_id', v_line ->> 'service_id',
+      'name', v_line ->> 'name',
+      'quantity', coalesce((v_line ->> 'quantity')::numeric, 1),
+      'unit_price', coalesce((v_line ->> 'unit_price')::numeric, 0),
+      'sort_order', v_idx);
+    v_idx := v_idx + 1;
+  END LOOP;
+
+  -- O pedido do atendimento. \`idempotency_key\` pelo agendamento: dois toques
+  -- no "Contratar" n\xE3o abrem duas contas para a mesma visita.
+  IF a.order_id IS NULL THEN
+    v_order := public.order_create(
+      p_kind => 'appointment',
+      p_lines => v_rpc_lines,
+      p_party_id => a.party_id,
+      p_unit_id => a.unit_id,
+      p_status => 'scheduled',
+      p_assignee_id => a.assignee_id,
+      p_metadata => jsonb_build_object('agenda', jsonb_build_object('booking_id', p_booking), 'source', 'clinical:contratacao'),
+      p_idempotency_key => 'clinical-contract:' || p_booking::text);
+    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = p_booking;
+  ELSE
+    -- Pedido j\xE1 existe (a agenda abriu na marca\xE7\xE3o): acrescenta o que falta.
+    v_order := a.order_id;
+    v_idx := coalesce((SELECT max(i.sort_order) + 1 FROM public.items i WHERE i.order_id = v_order), 0);
+    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+    LOOP
+      INSERT INTO public.items (tenant_id, unit_id, order_id, product_id, name, quantity, unit_price, total, sort_order)
+      VALUES (a.tenant_id, a.unit_id, v_order, (v_line ->> 'service_id')::uuid, v_line ->> 'name',
+              coalesce((v_line ->> 'quantity')::numeric, 1),
+              coalesce((v_line ->> 'unit_price')::numeric, 0),
+              coalesce((v_line ->> 'quantity')::numeric, 1) * coalesce((v_line ->> 'unit_price')::numeric, 0),
+              v_idx);
+      v_idx := v_idx + 1;
+    END LOOP;
+  END IF;
+
+  -- Cada sess\xE3o passa a apontar a SUA linha. Sem isto o pedido cobra e o
+  -- atendimento n\xE3o sabe o que executou \u2014 e a bola "Conta do atendimento"
+  -- nunca fecha, porque \xE9 exatamente este v\xEDnculo que ela procura.
+  UPDATE public.plg_clinical_sessions cs
+     SET order_item_id = i.id,
+         status = CASE WHEN cs.status IN ('quoted', 'pending', 'scheduled') THEN 'contracted' ELSE cs.status END,
+         updated_at = now()
+    FROM public.items i
+   WHERE cs.booking_id = p_booking
+     AND cs.order_item_id IS NULL
+     AND i.order_id = v_order
+     AND i.product_id = cs.service_id
+     AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions o
+                      WHERE o.order_item_id = i.id AND o.id <> cs.id);
+  GET DIAGNOSTICS v_n = ROW_COUNT;
+
+  RETURN jsonb_build_object(
+    'ok', true, 'order_id', v_order, 'sessoes_ligadas', v_n,
+    'total', (SELECT coalesce(sum(i.total), 0) FROM public.items i WHERE i.order_id = v_order),
+    'regua', public.clinical_requirements_refresh(p_booking));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_contract_services(uuid, jsonb) TO authenticated;
+`;
+var MIGRATION_007_FINALIZAR_ACENDE_O_BALCAO = `-- ============================================================================
+-- FINALIZAR acende o balc\xE3o
+--
+-- O \xFAltimo gesto do profissional \xE9 o PRIMEIRO da recep\xE7\xE3o. No V1, o instante em
+-- que o atendimento vai para \`completed\` sem \`checkout_confirmed_at\` acende o
+-- rodap\xE9 do balc\xE3o \u2014 com contador, pulso e bipe.
+--
+-- Duas decis\xF5es do V1 que v\xEAm junto, e que s\xE3o o oposto uma da outra:
+--
+--   \xB7 o aviso de servi\xE7os n\xE3o executados AVISA E DEIXA PASSAR. Travar criaria
+--     um atendimento sem sa\xEDda pela interface; quem n\xE3o executou cancela o item
+--     na conta do cliente. Por isso \`p_force\`: a primeira chamada devolve a
+--     lista, a segunda executa.
+--   \xB7 a exig\xEAncia que bloqueia TERMINAR (\`blocks_finish\`) \xE9 outra coisa, e essa
+--     trava de verdade \u2014 \xE9 o termo de sess\xE3o do V1, que existe para n\xE3o haver
+--     execu\xE7\xE3o sem assinatura.
+--
+-- E o que N\xC3O se grava aqui: \`checkout_confirmed_at\`. Ele \xE9 da recep\xE7\xE3o, e \xE9 o
+-- que tira o cart\xE3o da fila \u2014 receber e conferir s\xE3o duas coisas.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_attendance_finish(p_booking uuid, p_force boolean DEFAULT false)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_bloqueia jsonb; v_nao_executados jsonb;
+  v_avisados int := 0; v_total numeric := 0; v_cliente text;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+
+  -- A trava de verdade: exig\xEAncia que impede TERMINAR.
+  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', r.kind, 'service_id', r.service_id)), '[]'::jsonb)
+    INTO v_bloqueia
+    FROM public.plg_clinical_requirements r
+   WHERE r.booking_id = p_booking AND r.blocks_finish AND r.status = 'pending';
+  IF jsonb_array_length(v_bloqueia) > 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'exigencia_bloqueia', 'itens', v_bloqueia);
+  END IF;
+
+  -- O aviso que n\xE3o trava: servi\xE7os contratados e ainda n\xE3o executados.
+  SELECT coalesce(jsonb_agg(p.name ORDER BY p.name), '[]'::jsonb) INTO v_nao_executados
+    FROM public.plg_clinical_sessions cs
+    JOIN public.products p ON p.id = cs.service_id
+   WHERE cs.booking_id = p_booking AND cs.status <> 'executed';
+  IF jsonb_array_length(v_nao_executados) > 0 AND NOT coalesce(p_force, false) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'servicos_nao_executados', 'itens', v_nao_executados);
+  END IF;
+
+  -- "Finalizar agora registra estes servi\xE7os como executados" \u2014 texto do V1.
+  UPDATE public.plg_clinical_sessions
+     SET status = 'executed', ended_at = coalesce(ended_at, now()), updated_at = now()
+   WHERE booking_id = p_booking AND status <> 'executed';
+
+  UPDATE public.appointments
+     SET status = 'completed', updated_at = now()
+   WHERE id = p_booking;
+
+  -- Congela a trilha: depois de encerrado, a r\xE9gua n\xE3o se reapura.
+  PERFORM public.clinical_requirements_refresh(p_booking, true);
+
+  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = a.order_id;
+  SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
+
+  -- O BALC\xC3O ACENDE.
+  --
+  -- Quem recebe: a recep\xE7\xE3o da conta. Onde n\xE3o houver ningu\xE9m com o papel de
+  -- recep\xE7\xE3o \u2014 e \xE9 o caso do tenant migrado, com 0 membros nele \u2014, cai para
+  -- gerente e dono. Um aviso que n\xE3o chega a ningu\xE9m deixaria a conta parada
+  -- sem que nada na tela dissesse por qu\xEA.
+  WITH alvo AS (
+    SELECT m.user_id
+      FROM app.memberships m
+      JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
+       AND r.key IN ('recepcao', 'reception')
+    UNION ALL
+    SELECT m.user_id
+      FROM app.memberships m
+      JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
+       AND r.key IN ('owner', 'manager')
+       AND NOT EXISTS (
+         SELECT 1 FROM app.memberships m2 JOIN app.roles r2 ON r2.id = m2.role_id
+          WHERE m2.tenant_id = a.tenant_id AND coalesce(m2.active, true)
+            AND r2.key IN ('recepcao', 'reception'))
+  )
+  INSERT INTO public.notifications (tenant_id, user_id, title, body, type, link, subject_type, subject_id)
+  SELECT a.tenant_id, alvo.user_id,
+         'Checkout pendente',
+         coalesce(v_cliente, 'Cliente') || ' terminou o atendimento'
+           -- O dinheiro escrito como o Brasil escreve. \`to_char\` usa o
+           -- \`lc_numeric\` do BANCO para o grupo e a v\xEDrgula, e o cluster est\xE1
+           -- em C: sa\xEDa "R$ 999.00" no aviso de uma recep\xE7\xE3o brasileira. A
+           -- troca \xE9 feita \xE0 m\xE3o para n\xE3o depender de locale nenhum.
+           || CASE WHEN v_total > 0 THEN ' \xB7 R$ ' ||
+                replace(replace(replace(to_char(v_total, 'FM999G999G999D00'), ',', '\xA7'), '.', ','), '\xA7', '.')
+              ELSE '' END,
+         'checkout_pendente', '#/checkin', 'appointment', p_booking
+    FROM alvo
+  ON CONFLICT (user_id, subject_type, subject_id, type) WHERE subject_id IS NOT NULL DO NOTHING;
+  GET DIAGNOSTICS v_avisados = ROW_COUNT;
+
+  RETURN jsonb_build_object(
+    'ok', true, 'avisados', v_avisados, 'total', v_total,
+    'executados', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking AND status = 'executed'));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_attendance_finish(uuid, boolean) TO authenticated;
+`;
+var MIGRATION_008_CONFERIR_NAO_E_RECEBER = `-- ============================================================================
+-- CONFERIR n\xE3o \xE9 RECEBER
+--
+-- O V1 \xE9 expl\xEDcito: *"Receber move dinheiro; concluir checkout \xE9 a recep\xE7\xE3o
+-- dizendo 'conferi a sess\xE3o'. O cart\xE3o fica na fila enquanto houver valor em
+-- aberto OU checkout por confirmar."* S\xE3o duas coisas, e junt\xE1-las numa s\xF3
+-- faria a fila esvaziar quando o dinheiro entra \u2014 mesmo que ningu\xE9m tenha
+-- olhado o que foi executado.
+--
+-- \`checkout_confirmed_at\` mora no \`metadata->'agenda'\` do agendamento, que \xE9
+-- onde o ETL do V1 o deixou: 332 atendimentos migrados j\xE1 o carregam ali.
+-- Escrever numa coluna nova faria o hist\xF3rico e o presente responderem em
+-- lugares diferentes.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_checkout_confirm(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_aberto numeric := 0;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.status, ap.order_id, ap.metadata
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  -- Quem confere \xE9 quem est\xE1 no balc\xE3o. Diferente de iniciar o atendimento,
+  -- aqui N\xC3O se exige ser o profissional do agendamento: conferir \xE9 da
+  -- recep\xE7\xE3o, e a recep\xE7\xE3o n\xE3o atende ningu\xE9m.
+  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
+  v_person := public.current_person_id();
+
+  IF a.status <> 'completed' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_terminou');
+  END IF;
+  IF a.metadata -> 'agenda' ->> 'checkout_confirmed_at' IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', true, 'ja_confirmado', true);
+  END IF;
+
+  -- S\xF3 o ramo \`agenda\` \xE9 reescrito, e ele \xE9 reescrito a partir do que j\xE1
+  -- estava l\xE1: o \`||\` sobre o objeto inteiro apagaria o que o ETL do V1
+  -- deixou no metadata do agendamento.
+  UPDATE public.appointments ap
+     SET metadata = coalesce(ap.metadata, '{}'::jsonb)
+           || jsonb_build_object('agenda',
+                coalesce(ap.metadata -> 'agenda', '{}'::jsonb)
+                || jsonb_build_object(
+                     'checkout_confirmed_at', to_jsonb(now()),
+                     'checkout_confirmed_by', to_jsonb(coalesce(v_person::text, auth.uid()::text)))),
+         updated_at = now()
+   WHERE ap.id = p_booking;
+
+  -- O aviso cumpriu o papel dele. Deix\xE1-lo n\xE3o lido faria o sino cobrar uma
+  -- confer\xEAncia que j\xE1 aconteceu.
+  UPDATE public.notifications
+     SET read = true
+   WHERE subject_type = 'appointment' AND subject_id = p_booking AND NOT read;
+
+  SELECT coalesce(sum(i.total), 0) INTO v_aberto FROM public.items i WHERE i.order_id = a.order_id;
+
+  RETURN jsonb_build_object('ok', true, 'total', v_aberto);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_checkout_confirm(uuid) TO authenticated;
+`;
+var MIGRATION_009_O_BOTAO_DE_COBRAR_COBRA = `-- ============================================================================
+-- O bot\xE3o de cobrar COBRA
+--
+-- SINTOMA, visto na tela: a conta do cliente mostra "Este atendimento ainda n\xE3o
+-- tem cobran\xE7a \xB7 **Gerar recebimento**", e o clique n\xE3o faz nada. Nenhum
+-- movimento nasce, nenhuma mensagem aparece. O bot\xE3o existe porque o painel o
+-- oferece, e quem o liga \xE9 o APP hospedeiro \u2014 que neste app n\xE3o liga.
+--
+-- Bot\xE3o morto \xE9 pior que bot\xE3o ausente: quem clica confia no bot\xE3o.
+--
+-- O caminho do dinheiro no V2 \xE9 um s\xF3: o receb\xEDvel \xE9 levantado quando o PEDIDO
+-- FECHA (\`orders_raise_receivable_on_close\`). Ent\xE3o cobrar \xE9 fechar o pedido do
+-- atendimento \u2014 e n\xE3o escrever fatura \xE0 m\xE3o, que \xE9 o que a regra do SDK pro\xEDbe.
+--
+-- \xC9 aqui, e n\xE3o na contrata\xE7\xE3o, porque o V1 separa as duas coisas: contratar
+-- cria a d\xEDvida; cobrar \xE9 da recep\xE7\xE3o, depois de conferir o que foi executado.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_checkout_charge(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_linhas int; v_total numeric; v_mov int;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.status, ap.order_id INTO a
+    FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
+
+  IF a.order_id IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
+  END IF;
+
+  SELECT count(*), coalesce(sum(i.total), 0) INTO v_linhas, v_total
+    FROM public.items i WHERE i.order_id = a.order_id;
+  IF v_linhas = 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
+  END IF;
+
+  -- Idempotente: o pedido j\xE1 fechado devolve o que existe, sem levantar um
+  -- segundo receb\xEDvel para a mesma visita.
+  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
+  IF v_mov > 0 THEN
+    RETURN jsonb_build_object('ok', true, 'ja_cobrado', true, 'total', v_total);
+  END IF;
+
+  UPDATE public.orders SET status = 'completed', updated_at = now()
+   WHERE id = a.order_id AND status <> 'completed';
+
+  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
+  RETURN jsonb_build_object('ok', true, 'total', v_total, 'movimentos', v_mov);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_checkout_charge(uuid) TO authenticated;
+`;
+var MIGRATION_010_A_INDICACAO_VAI_PARA_O_FUNIL = `-- ============================================================================
+-- A INDICA\xC7\xC3O vai para o funil
+--
+-- O V1 escreve, na pr\xF3pria tela da avalia\xE7\xE3o: *"Indique procedimentos ou
+-- produtos para o cliente \u2014 eles alimentam as recomenda\xE7\xF5es do CRM e a etapa de
+-- or\xE7amento."* E a rede confirma: concluir a avalia\xE7\xE3o faz \`POST
+-- opportunity_recommendations\`.
+--
+-- **Indica\xE7\xE3o n\xE3o \xE9 venda.** \xC9 o que o profissional recomenda; virar cobran\xE7a \xE9
+-- outra decis\xE3o, do paciente, na contrata\xE7\xE3o. As duas palavras existem
+-- separadas no V1 porque separam dois momentos e duas responsabilidades.
+--
+-- No V2 a cesta do interesse pende de um NEG\xD3CIO (\`plg_crm_deal_interests.
+-- deal_id\` \xE9 NOT NULL). Ent\xE3o a avalia\xE7\xE3o abre \u2014 ou reaproveita \u2014 um neg\xF3cio do
+-- cliente e pendura ali o que foi indicado. \xC9 o mesmo desenho do V1, com o
+-- vocabul\xE1rio do V2: a indica\xE7\xE3o nasce no atendimento e vive no funil.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_evaluation_complete(p_booking uuid, p_lines jsonb DEFAULT '[]'::jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_deal uuid; v_line jsonb; v_interest uuid;
+  v_n int := 0; v_resolvidas int := 0; v_cliente text;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+
+  IF jsonb_typeof(p_lines) = 'array' AND jsonb_array_length(p_lines) > 0 THEN
+    SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
+
+    -- O neg\xF3cio do cliente. Reaproveita o que estiver aberto: duas avalia\xE7\xF5es
+    -- no mesmo m\xEAs s\xE3o a mesma conversa, e abrir um funil por atendimento faria
+    -- o quadro do CRM virar hist\xF3rico de agenda.
+    SELECT d.id INTO v_deal FROM public.plg_crm_deals d
+     WHERE d.tenant_id = a.tenant_id AND d.contact_id = a.party_id AND d.status = 'open'
+     ORDER BY d.created_at DESC LIMIT 1;
+
+    IF v_deal IS NULL THEN
+      INSERT INTO public.plg_crm_deals (tenant_id, unit_id, title, contact_id, assigned_to_id, metadata)
+      VALUES (a.tenant_id, a.unit_id,
+              'Avalia\xE7\xE3o \u2014 ' || coalesce(v_cliente, 'cliente'), a.party_id, a.assignee_id,
+              jsonb_build_object('source', 'clinical:avaliacao', 'booking_id', p_booking))
+      RETURNING id INTO v_deal;
+    END IF;
+
+    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+    LOOP
+      -- Idempotente por (neg\xF3cio, produto): indicar duas vezes o mesmo
+      -- procedimento \xE9 corrigir a quantidade, n\xE3o criar uma segunda indica\xE7\xE3o.
+      SELECT i.id INTO v_interest FROM public.plg_crm_deal_interests i
+       WHERE i.deal_id = v_deal AND i.product_id = (v_line ->> 'service_id')::uuid;
+
+      IF v_interest IS NULL THEN
+        INSERT INTO public.plg_crm_deal_interests
+          (tenant_id, unit_id, deal_id, product_id, quantity, origin, status, notes, metadata)
+        VALUES (a.tenant_id, a.unit_id, v_deal, (v_line ->> 'service_id')::uuid,
+                greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1),
+                'indication', 'open', nullif(v_line ->> 'notes', ''),
+                jsonb_build_object('source', 'clinical:avaliacao', 'booking_id', p_booking))
+        RETURNING id INTO v_interest;
+        v_n := v_n + 1;
+      ELSE
+        UPDATE public.plg_crm_deal_interests
+           SET quantity = greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1), updated_at = now()
+         WHERE id = v_interest;
+      END IF;
+
+      INSERT INTO public.plg_crm_deal_interest_appointments (tenant_id, unit_id, appointment_id, interest_id)
+      SELECT a.tenant_id, a.unit_id, p_booking, v_interest
+       WHERE NOT EXISTS (SELECT 1 FROM public.plg_crm_deal_interest_appointments x
+                          WHERE x.appointment_id = p_booking AND x.interest_id = v_interest);
+    END LOOP;
+  END IF;
+
+  -- A bola da avalia\xE7\xE3o fecha apontando a SESS\xC3O em que ela aconteceu. O V1
+  -- resolve pelo v\xEDnculo com a execu\xE7\xE3o da avalia\xE7\xE3o; aqui a avalia\xE7\xE3o \xE9 este
+  -- atendimento, e o que ela deixa registrado \xE9 o que ele indicou.
+  UPDATE public.plg_clinical_requirements r
+     SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = r.session_id,
+         resolved_via = 'attendance', resolved_at = now(), updated_at = now()
+   WHERE r.booking_id = p_booking AND r.kind = 'evaluation' AND r.status = 'pending'
+     AND r.frozen_at IS NULL AND r.session_id IS NOT NULL;
+  GET DIAGNOSTICS v_resolvidas = ROW_COUNT;
+
+  RETURN jsonb_build_object('ok', true, 'deal_id', v_deal, 'indicacoes', v_n, 'bolas_fechadas', v_resolvidas);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_evaluation_complete(uuid, jsonb) TO authenticated;
+`;
+var MIGRATION_011_INTERESSE_E_INDICACAO_NA_MESMA_LINHA = `-- ============================================================================
+-- INTERESSE e INDICA\xC7\xC3O na MESMA LINHA
+--
+-- O desfecho do desenho do V1, e a captura que o documenta mostra a linha
+-- inteira:
+--
+--     \xC1cido Hialur\xF4nico \u2014 R$ 999,00
+--     Interesse do cliente \xB7 Indicado pelo profissional
+--
+-- S\xE3o tr\xEAs palavras e tr\xEAs momentos: **interesse** \xE9 o que o cliente pediu ao
+-- marcar; **indica\xE7\xE3o** \xE9 o que o profissional recomendou na avalia\xE7\xE3o;
+-- **contrata\xE7\xE3o** \xE9 o que virou cobran\xE7a. O mesmo servi\xE7o pode carregar as duas
+-- primeiras \u2014 e a\xED ele aparece UMA vez, com as duas origens somadas no r\xF3tulo.
+--
+-- Duas linhas para o mesmo procedimento fariam a recep\xE7\xE3o cobrar duas vezes; e
+-- esconder a origem faria o paciente ouvir "o senhor pediu" sobre algo que foi
+-- recomendado. Por isso a fus\xE3o \xE9 do BANCO, e n\xE3o de cada tela que precisar
+-- dela.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_contract_candidates(p_booking uuid)
+RETURNS TABLE (
+  service_id uuid,
+  name text,
+  price numeric,
+  quantity numeric,
+  from_interest boolean,
+  from_indication boolean,
+  already_contracted boolean
+) LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+  WITH alvo AS (
+    SELECT ap.id, ap.tenant_id, ap.party_id, ap.order_id FROM public.appointments ap WHERE ap.id = p_booking
+  ),
+  -- O que o cliente pediu ao marcar.
+  interesse AS (
+    SELECT ai.service_id, max(ai.name) AS name, max(ai.price) AS price, count(*)::numeric AS qtd
+      FROM public.appointment_items ai, alvo
+     WHERE ai.booking_id = alvo.id AND ai.service_id IS NOT NULL
+     GROUP BY ai.service_id
+  ),
+  -- O que o profissional recomendou \u2014 deste atendimento ou do neg\xF3cio aberto
+  -- do cliente, que \xE9 onde a avalia\xE7\xE3o pendura o que indicou.
+  indicacao AS (
+    SELECT i.product_id AS service_id, max(i.quantity) AS qtd
+      FROM public.plg_crm_deal_interests i
+      JOIN public.plg_crm_deals d ON d.id = i.deal_id, alvo
+     WHERE i.tenant_id = alvo.tenant_id AND i.status = 'open'
+       AND (d.contact_id = alvo.party_id
+            OR EXISTS (SELECT 1 FROM public.plg_crm_deal_interest_appointments x
+                        WHERE x.interest_id = i.id AND x.appointment_id = alvo.id))
+     GROUP BY i.product_id
+  ),
+  -- O que j\xE1 virou cobran\xE7a nesta visita: aparece marcado, n\xE3o some \u2014 sumir
+  -- faria a lista mentir sobre o que foi combinado.
+  contratado AS (
+    SELECT it.product_id AS service_id FROM public.items it, alvo
+     WHERE alvo.order_id IS NOT NULL AND it.order_id = alvo.order_id AND it.product_id IS NOT NULL
+  )
+  SELECT
+    coalesce(i.service_id, n.service_id) AS service_id,
+    coalesce(i.name, p.name) AS name,
+    coalesce(nullif(i.price, 0), p.price, 0) AS price,
+    greatest(coalesce(i.qtd, 0), coalesce(n.qtd, 0), 1) AS quantity,
+    i.service_id IS NOT NULL AS from_interest,
+    n.service_id IS NOT NULL AS from_indication,
+    EXISTS (SELECT 1 FROM contratado c WHERE c.service_id = coalesce(i.service_id, n.service_id)) AS already_contracted
+  FROM interesse i
+  FULL OUTER JOIN indicacao n ON n.service_id = i.service_id
+  LEFT JOIN public.products p ON p.id = coalesce(i.service_id, n.service_id)
+  ORDER BY 2;
+$fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_contract_candidates(uuid) TO authenticated;
+`;
+var MIGRATION_012_O_QUE_FOI_USADO_ESPERA_APROVACAO = `-- ============================================================================
+-- O QUE FOI USADO espera aprova\xE7\xE3o
+--
+-- A bola de produtos do V1, e a frase que a define: *"Ele vem tudo pra c\xE1
+-- primeiro. Vem pra aprova\xE7\xE3o de dispensa."* **Nada baixa aqui.** O consumo
+-- declarado pelo profissional cai na fila da Auditoria de Uso, e \xE9 l\xE1 que
+-- algu\xE9m confirma \u2014 ou corrige a quantidade lan\xE7ada errada.
+--
+-- Registrar consumo baixando estoque na hora seria transformar a mem\xF3ria de
+-- quem atende em movimento cont\xE1bil sem confer\xEAncia, que \xE9 exatamente o que a
+-- auditoria existe para evitar.
+--
+-- \`is_audited = false\` \xE9 o estado inicial, e \xE9 o que p\xF5e a linha na fila.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_products_record(p_booking uuid, p_lines jsonb DEFAULT '[]'::jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_line jsonb; v_session uuid; v_n int := 0; v_marcadas int := 0;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.assignee_id, ap.status
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+
+  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_lines, '[]'::jsonb))
+  LOOP
+    -- A sess\xE3o do SERVI\xC7O que consumiu. O V1 desenha um bloco por servi\xE7o
+    -- justamente porque a mesma seringa gasta em procedimentos diferentes, e
+    -- juntar tudo num monte perde de qual execu\xE7\xE3o veio.
+    SELECT cs.id INTO v_session FROM public.plg_clinical_sessions cs
+     WHERE cs.booking_id = p_booking AND cs.service_id = (v_line ->> 'service_id')::uuid
+     ORDER BY cs.created_at LIMIT 1;
+    IF v_session IS NULL THEN CONTINUE; END IF;
+
+    INSERT INTO public.plg_clinical_session_products
+      (tenant_id, unit_id, session_id, product_id, assignee_id, used_quantity, used_unit_id, executed_on, is_audited)
+    SELECT a.tenant_id, a.unit_id, v_session, (v_line ->> 'product_id')::uuid, v_person,
+           greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 0),
+           nullif(v_line ->> 'unit_id', '')::uuid, current_date, false
+     WHERE NOT EXISTS (
+       SELECT 1 FROM public.plg_clinical_session_products sp
+        WHERE sp.session_id = v_session AND sp.product_id = (v_line ->> 'product_id')::uuid);
+    IF FOUND THEN
+      v_n := v_n + 1;
+    ELSE
+      UPDATE public.plg_clinical_session_products
+         SET used_quantity = greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 0), updated_at = now()
+       WHERE session_id = v_session AND product_id = (v_line ->> 'product_id')::uuid AND NOT is_audited;
+    END IF;
+  END LOOP;
+
+  -- Conferido \xE9 conferido, mesmo que n\xE3o tenha sido usado nada: "n\xE3o usei
+  -- produto neste procedimento" \xE9 uma resposta, e sem poder d\xE1-la a bola ficaria
+  -- pendente para sempre em quem n\xE3o gasta insumo.
+  UPDATE public.plg_clinical_sessions
+     SET products_initialized = true, updated_at = now()
+   WHERE booking_id = p_booking AND coalesce(products_initialized, false) = false;
+  GET DIAGNOSTICS v_marcadas = ROW_COUNT;
+
+  RETURN jsonb_build_object(
+    'ok', true, 'lancados', v_n, 'sessoes_conferidas', v_marcadas,
+    'regua', public.clinical_requirements_refresh(p_booking));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_products_record(uuid, jsonb) TO authenticated;
+`;
+var MIGRATION_013_O_QUE_COUBER_HOJE = `-- ============================================================================
+-- O QUE COUBER HOJE
+--
+-- *"Marque os servi\xE7os que ser\xE3o executados agora. Os demais ficam contratados
+-- para execu\xE7\xE3o em outro atendimento."* \xC9 o di\xE1logo que o V1 abre depois da
+-- contrata\xE7\xE3o, e ele existe por causa de uma frase da demonstra\xE7\xE3o: *"o labial
+-- veio com uma festa amanh\xE3, n\xE3o quero ficar com o l\xE1bio roxo"*.
+--
+-- \xC9 este passo que separa **contratado** de **executado** \u2014 e \xE9 dele que nasce
+-- o saldo *a executar* na conta do cliente. Sem ele, contratar tr\xEAs sess\xF5es
+-- significaria executar tr\xEAs sess\xF5es no mesmo dia, o que n\xE3o \xE9 como uma cl\xEDnica
+-- funciona.
+--
+-- O que N\xC3O se executa hoje n\xE3o vira pend\xEAncia do atendimento: fica contratado,
+-- pago ou a pagar, esperando outra data.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_execute_services(p_booking uuid, p_service_ids uuid[])
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_executadas int := 0; v_adiadas int := 0;
+BEGIN
+  SELECT ap.id, ap.assignee_id, ap.status INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+
+  UPDATE public.plg_clinical_sessions cs
+     SET status = 'executed', ended_at = coalesce(cs.ended_at, now()), updated_at = now()
+   WHERE cs.booking_id = p_booking
+     AND cs.service_id = ANY (coalesce(p_service_ids, ARRAY[]::uuid[]))
+     AND cs.status <> 'executed';
+  GET DIAGNOSTICS v_executadas = ROW_COUNT;
+
+  -- O que ficou de fora volta a CONTRATADO \u2014 e n\xE3o a pendente: foi combinado e
+  -- continua combinado, s\xF3 que para outra data. Desmarcar depois de ter
+  -- executado por engano \xE9 o caso que esta linha resolve.
+  UPDATE public.plg_clinical_sessions cs
+     SET status = 'contracted', ended_at = NULL, updated_at = now()
+   WHERE cs.booking_id = p_booking
+     AND NOT (cs.service_id = ANY (coalesce(p_service_ids, ARRAY[]::uuid[])))
+     AND cs.status = 'executed';
+  GET DIAGNOSTICS v_adiadas = ROW_COUNT;
+
+  RETURN jsonb_build_object('ok', true, 'executadas', v_executadas, 'adiadas', v_adiadas);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_execute_services(uuid, uuid[]) TO authenticated;
+`;
+var MIGRATION_014_O_PAGO_A_EXECUTAR_DEIXA_DE_SER_INVISIVEL = `-- ============================================================================
+-- O "PAGO A EXECUTAR" deixa de ser invis\xEDvel
+--
+-- O tipo \`ClientAccount\` do financeiro traz este coment\xE1rio, escrito quando o
+-- porte come\xE7ou:
+--
+--   "\`paidToExecute\` (o 'pago a executar' do V1) \xE9 o valor j\xE1 recebido de
+--    servi\xE7o ainda n\xE3o prestado: num sal\xE3o isso \xE9 PASSIVO, n\xE3o receita. Fica
+--    opcional porque o V2 ainda n\xE3o tem o eixo de EXECU\xC7\xC3O \u2014 modela pagamento e
+--    n\xE3o modela entrega \u2014, e um zero fixo ali mentiria sobre uma d\xEDvida."
+--
+-- O eixo passou a existir: \`plg_clinical_sessions.status\` separa **contratado**
+-- de **executado**, e a etapa "o que couber hoje" \xE9 quem move uma para a outra.
+-- Ent\xE3o a conta pode responder \u2014 e a regra de honestidade se inverte: agora
+-- OMITIR o n\xFAmero esconderia a d\xEDvida.
+--
+-- A vista \xE9 do plugin cl\xEDnico porque o dado \xE9 dele. O financeiro l\xEA se ela
+-- existir; onde o prontu\xE1rio n\xE3o est\xE1 instalado, a conta continua sem o cart\xE3o,
+-- que \xE9 a resposta certa para quem n\xE3o tem execu\xE7\xE3o para acompanhar.
+-- ============================================================================
+
+CREATE OR REPLACE VIEW public.v_clinical_to_execute AS
+WITH sessao AS (
+  SELECT
+    cs.tenant_id,
+    cs.party_id,
+    cs.order_item_id,
+    cs.status,
+    i.order_id,
+    coalesce(i.total, 0) AS item_total
+  FROM public.plg_clinical_sessions cs
+  JOIN public.items i ON i.id = cs.order_item_id
+  WHERE cs.party_id IS NOT NULL
+    AND cs.status IN ('contracted', 'quoted', 'in_service', 'scheduled', 'pending')
+),
+-- Quanto do PEDIDO j\xE1 foi recebido, em propor\xE7\xE3o: o pagamento \xE9 por parcela e
+-- n\xE3o por item, ent\xE3o a fatia paga de cada item \xE9 a fatia paga do pedido.
+pago AS (
+  SELECT m.invoice_id AS order_id,
+         sum(coalesce(m.paid_amount, 0)) AS pago,
+         nullif(sum(coalesce(m.amount, 0)), 0) AS total
+    FROM public.plg_financial_movements m
+   WHERE m.direction = 'credit'
+   GROUP BY m.invoice_id
+)
+SELECT
+  s.tenant_id,
+  s.party_id,
+  sum(s.item_total * coalesce(p.pago / p.total, 0))::numeric(14,2) AS paid_to_execute,
+  sum(s.item_total * (1 - coalesce(p.pago / p.total, 0)))::numeric(14,2) AS open_to_execute,
+  count(*)::int AS sessions_to_execute
+FROM sessao s
+LEFT JOIN pago p ON p.order_id = s.order_id
+GROUP BY s.tenant_id, s.party_id;
+
+COMMENT ON VIEW public.v_clinical_to_execute IS
+  'O que o cliente j\xE1 contratou e ainda N\xC3O foi executado, separado em pago e em aberto. O "pago a executar" do V1 \xE9 passivo: dinheiro recebido de servi\xE7o que a casa ainda deve prestar.';
+
+GRANT SELECT ON public.v_clinical_to_execute TO authenticated;
+`;
+var MIGRATION_015_A_REVISAO_APONTA_O_QUE_REVISA = `-- ============================================================================
+-- A REVIS\xC3O aponta O QUE ela revisa
+--
+-- Revis\xE3o \xE9 o retorno de um procedimento que j\xE1 foi feito \u2014 e ela s\xF3 significa
+-- alguma coisa se disser DE QUAL. Sem o v\xEDnculo, o hist\xF3rico do paciente fica
+-- com um "Revis\xE3o" solto, e ningu\xE9m consegue responder, meses depois, o que foi
+-- revisado nem se ainda estava no prazo.
+--
+-- Por isso a exig\xEAncia \`revision_link\` do V1 \xE9 a \xFAnica que trava as DUAS pontas:
+-- \`blocks_start\` e \`blocks_finish\`. N\xE3o se come\xE7a uma revis\xE3o sem saber do qu\xEA,
+-- e n\xE3o se encerra sem ter dito.
+--
+-- O modal do V1 mudou em 21/09 (\`2e1a119ef\`): passou a listar **todo servi\xE7o
+-- executado**, com o **prazo \xE0 vista**, em vez de s\xF3 os candidatos filtrados \u2014
+-- porque quem atende sabe reconhecer o procedimento na lista, e um filtro
+-- silencioso esconde justamente o caso fora do padr\xE3o.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_revision_candidates(p_booking uuid)
+RETURNS TABLE (
+  session_id uuid,
+  service_id uuid,
+  service_name text,
+  executed_on timestamptz,
+  deadline_days integer,
+  days_since integer,
+  within_deadline boolean
+) LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+  WITH alvo AS (
+    SELECT ap.tenant_id, ap.party_id FROM public.appointments ap WHERE ap.id = p_booking
+  )
+  SELECT
+    cs.id,
+    cs.service_id,
+    p.name,
+    coalesce(cs.ended_at, cs.scheduled_for) AS executed_on,
+    rev.deadline_days,
+    (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date)::int AS days_since,
+    -- Prazo ausente n\xE3o vira "fora do prazo": vira SEM prazo, e a tela diz isso.
+    CASE WHEN rev.deadline_days IS NULL THEN NULL
+         ELSE (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date) <= rev.deadline_days
+    END AS within_deadline
+  FROM public.plg_clinical_sessions cs
+  JOIN alvo a ON a.tenant_id = cs.tenant_id AND a.party_id = cs.party_id
+  LEFT JOIN public.products p ON p.id = cs.service_id
+  LEFT JOIN LATERAL (
+    SELECT r.deadline_days FROM public.plg_clinical_service_revisions r
+     WHERE r.tenant_id = cs.tenant_id AND r.service_id = cs.service_id
+     ORDER BY r.revision_number LIMIT 1
+  ) rev ON true
+  WHERE cs.status = 'executed'
+    AND cs.booking_id IS DISTINCT FROM p_booking
+  ORDER BY coalesce(cs.ended_at, cs.scheduled_for) DESC NULLS LAST
+  LIMIT 50;
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.clinical_link_revision(p_session uuid, p_parent_session uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  s record; v_person uuid; v_booking uuid;
+BEGIN
+  SELECT cs.id, cs.booking_id, cs.tenant_id, cs.party_id INTO s
+    FROM public.plg_clinical_sessions cs WHERE cs.id = p_session;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+
+  -- O original tem de ser do MESMO paciente. Revisar o procedimento de outra
+  -- pessoa n\xE3o \xE9 engano de digita\xE7\xE3o: \xE9 prontu\xE1rio trocado.
+  IF NOT EXISTS (
+    SELECT 1 FROM public.plg_clinical_sessions p
+     WHERE p.id = p_parent_session AND p.party_id = s.party_id AND p.tenant_id = s.tenant_id
+  ) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'original_de_outro_paciente');
+  END IF;
+
+  UPDATE public.plg_clinical_sessions
+     SET parent_session_id = p_parent_session, updated_at = now()
+   WHERE id = p_session;
+
+  v_booking := s.booking_id;
+  RETURN jsonb_build_object('ok', true, 'regua', public.clinical_requirements_refresh(v_booking));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_revision_candidates(uuid) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.clinical_link_revision(uuid, uuid) TO authenticated;
+`;
+var MIGRATION_016_A_COMPRA_ANTECIPADA_NAO_TEM_AGENDAMENTO_ATRAS = `-- ============================================================================
+-- A COMPRA ANTECIPADA n\xE3o tem agendamento atr\xE1s
+--
+-- O caso que a demonstra\xE7\xE3o do V1 narra: *"T\xE1 na promo\xE7\xE3o, vou comprar esse
+-- Botox e deixar guardado."* A recep\xE7\xE3o abre **Contas a Receber \u2192 Inserir**,
+-- escolhe o servi\xE7o, aplica o desconto combinado e recebe \u2014 **sem agendamento,
+-- sem contrato e sem proposta**. O V1 \xE9 expl\xEDcito: *"N\xE3o precisa de contrato?
+-- N\xE3o. N\xE3o precisa de proposta? N\xE3o."*
+--
+-- O efeito aparece na CONTA DA CLIENTE: um item **a executar**, pago, esperando
+-- o dia. \xC9 por isso que ele \xE9 passivo \u2014 a casa recebeu e ainda deve prestar \u2014,
+-- e \xE9 por isso que ele precisa nascer como SESS\xC3O: sem sess\xE3o, "a executar" n\xE3o
+-- existe como estado, e o dinheiro entraria como receita de um servi\xE7o que
+-- ningu\xE9m fez.
+--
+-- Sess\xE3o sem \`booking_id\` \xE9 o que distingue esta compra de um atendimento: ela
+-- ainda n\xE3o tem dia. Ganha um quando for agendada.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_prepay_services(p_party uuid, p_lines jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  v_tenant uuid; v_unit uuid; v_order uuid; v_line jsonb;
+  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0; v_sessoes int := 0; v_total numeric;
+BEGIN
+  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
+  v_tenant := app.current_tenant_id();
+  IF v_tenant IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_tenant'); END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.people p WHERE p.id = p_party AND p.tenant_id = v_tenant) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'cliente_nao_encontrado');
+  END IF;
+  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_escolhido');
+  END IF;
+
+  v_unit := app.requested_unit();
+
+  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+  LOOP
+    v_rpc_lines := v_rpc_lines || jsonb_build_object(
+      'product_id', v_line ->> 'service_id',
+      'name', v_line ->> 'name',
+      'quantity', greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1),
+      'unit_price', greatest(coalesce((v_line ->> 'unit_price')::numeric, 0), 0),
+      'sort_order', v_idx);
+    v_idx := v_idx + 1;
+  END LOOP;
+
+  v_order := public.order_create(
+    p_kind => 'sale',
+    p_lines => v_rpc_lines,
+    p_party_id => p_party,
+    p_unit_id => v_unit,
+    -- Nasce CONFIRMADO e fecha logo abaixo, em dois tempos \u2014 e isso n\xE3o \xE9
+    -- cerim\xF4nia: o gatilho que levanta o receb\xEDvel \xE9 \`AFTER UPDATE OF status\`,
+    -- ent\xE3o um pedido criado j\xE1 \`completed\` **vende sem cobrar**. Medido: a
+    -- primeira vers\xE3o desta fun\xE7\xE3o criou a compra fechada e a conta ficou com
+    -- "a executar" e ZERO cobran\xE7a.
+    -- (\`scheduled\` nem \xE9 aceito para \`sale\`: o contrato de estados do pedido
+    -- permite draft, confirmed, completed e cancelled.)
+    p_status => 'confirmed',
+    p_metadata => jsonb_build_object('source', 'clinical:compra-antecipada'),
+    p_idempotency_key => NULL);
+
+  -- Uma sess\xE3o por item, SEM dia. \xC9 ela que sustenta o "a executar" na conta \u2014
+  -- e o que permite, quando o dia chegar, amarrar a execu\xE7\xE3o ao que j\xE1 foi pago.
+  INSERT INTO public.plg_clinical_sessions
+    (tenant_id, unit_id, status, party_id, service_id, order_item_id)
+  SELECT v_tenant, v_unit, 'contracted', p_party, i.product_id, i.id
+    FROM public.items i
+   WHERE i.order_id = v_order AND i.product_id IS NOT NULL;
+  GET DIAGNOSTICS v_sessoes = ROW_COUNT;
+
+  -- O fechamento, agora como UPDATE: \xE9 ele que dispara
+  -- \`orders_raise_receivable_on_close\` e faz nascer a conta a receber.
+  UPDATE public.orders SET status = 'completed', updated_at = now() WHERE id = v_order;
+
+  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = v_order;
+
+  RETURN jsonb_build_object('ok', true, 'order_id', v_order, 'sessoes', v_sessoes, 'total', v_total);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_prepay_services(uuid, jsonb) TO authenticated;
+`;
+var MIGRATION_017_O_QUE_JA_FOI_PAGO_NAO_SE_COBRA_DE_NOVO = `-- ============================================================================
+-- O QUE J\xC1 FOI PAGO n\xE3o se cobra de novo
+--
+-- A compra antecipada deixa uma sess\xE3o **sem dia**: o Botox comprado na
+-- promo\xE7\xE3o, esperando. Quando o dia chega, o atendimento come\xE7ava criando uma
+-- sess\xE3o NOVA para o mesmo servi\xE7o \u2014 e a\xED a cliente tinha duas: a que pagou e a
+-- que acabou de ser aberta. A primeira ficava "a executar" para sempre, e a
+-- segunda entrava na contrata\xE7\xE3o como se nada tivesse sido pago.
+--
+-- \xC9 a mesma pessoa, o mesmo servi\xE7o e o mesmo dinheiro. Ent\xE3o o in\xEDcio do
+-- atendimento ADOTA a sess\xE3o que j\xE1 existe: ela ganha o dia, o profissional e o
+-- item do agendamento, e deixa de pender na conta.
+--
+-- A escolha \xE9 a mais ANTIGA: quem comprou duas vezes executa primeiro o que
+-- comprou primeiro \u2014 e \xE9 isso que faz o saldo andar em vez de envelhecer.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_created int := 0; v_adotadas int := 0;
+  v_item record; v_refresh jsonb; v_antiga uuid;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.starts_at
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
+  END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
+  END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
+  END IF;
+  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
+  END IF;
+
+  FOR v_item IN
+    SELECT ai.id, ai.service_id, ai.assignee_id
+      FROM public.appointment_items ai
+     WHERE ai.booking_id = p_booking
+  LOOP
+    -- J\xE1 existe sess\xE3o para este item? (dois toques, duas pessoas ao mesmo tempo)
+    CONTINUE WHEN EXISTS (
+      SELECT 1 FROM public.plg_clinical_sessions cs
+       WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
+
+    -- O QUE FOI COMPRADO ANTES E AINDA N\xC3O SAIU: adota em vez de criar.
+    SELECT cs.id INTO v_antiga
+      FROM public.plg_clinical_sessions cs
+     WHERE cs.tenant_id = a.tenant_id
+       AND cs.party_id = a.party_id
+       AND cs.service_id = v_item.service_id
+       AND cs.booking_id IS NULL
+       AND cs.status IN ('contracted', 'quoted', 'pending')
+     ORDER BY cs.created_at
+     LIMIT 1;
+
+    IF v_antiga IS NOT NULL THEN
+      UPDATE public.plg_clinical_sessions
+         SET booking_id = p_booking,
+             booking_item_id = v_item.id,
+             unit_id = coalesce(a.unit_id, unit_id),
+             assignee_id = coalesce(v_item.assignee_id, a.assignee_id),
+             performed_by_id = v_person,
+             status = 'in_service',
+             scheduled_for = a.starts_at,
+             started_at = coalesce(started_at, now()),
+             updated_at = now()
+       WHERE id = v_antiga;
+      v_adotadas := v_adotadas + 1;
+    ELSE
+      INSERT INTO public.plg_clinical_sessions (
+        tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
+        assignee_id, performed_by_id, service_id, scheduled_for, started_at)
+      VALUES (a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
+              coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
+              a.starts_at, now());
+      v_created := v_created + 1;
+    END IF;
+  END LOOP;
+
+  UPDATE public.appointments
+     SET status = 'in_progress', updated_at = now()
+   WHERE id = p_booking AND status <> 'in_progress';
+
+  v_refresh := public.clinical_requirements_refresh(p_booking);
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'sessoes_criadas', v_created,
+    'sessoes_adotadas', v_adotadas,
+    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
+    'regua', v_refresh);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
+`;
+var MIGRATION_018_O_QUE_FOI_CONTRATADO_VIRA_SESSAO = `-- O que foi contratado vira SESS\xC3O, mesmo sem agendamento atr\xE1s dele.
+--
+-- A 006 s\xF3 LIGAVA sess\xF5es j\xE1 existentes \xE0s linhas do pedido. Servi\xE7o indicado
+-- na avalia\xE7\xE3o e contratado na hora n\xE3o tem sess\xE3o nenhuma para ligar: a conta
+-- ficava com "Botox Full Face \xB7 2 \xB7 R$ 2.798,00" e o prontu\xE1rio n\xE3o sabia que
+-- havia dois Botox a executar. O dinheiro entrava e a execu\xE7\xE3o sumia \u2014 nem na
+-- r\xE9gua, nem em \`v_clinical_to_execute\`, nem no di\xE1logo de "Executar".
+--
+-- Uma sess\xE3o POR UNIDADE, porque \xE9 assim que a execu\xE7\xE3o acontece: dois Botox
+-- contratados s\xE3o duas idas \xE0 cadeira, e executar um hoje n\xE3o pode fechar o
+-- outro. O \`booking_id\` \xE9 o do atendimento onde foi contratado \u2014 quem n\xE3o for
+-- executado hoje continua \`contracted\`, que \xE9 o estado de "a executar".
+
+CREATE OR REPLACE FUNCTION public.clinical_sessions_for_order(p_booking uuid, p_order uuid)
+RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $fn$
+DECLARE
+  a       public.appointments%ROWTYPE;
+  v_item  record;
+  v_faltam integer;
+  v_k      integer;
+  v_total  integer := 0;
+BEGIN
+  SELECT * INTO a FROM public.appointments WHERE id = p_booking;
+  IF NOT FOUND THEN RETURN 0; END IF;
+
+  FOR v_item IN
+    SELECT i.id, i.product_id, i.quantity,
+           (SELECT count(*) FROM public.plg_clinical_sessions s WHERE s.order_item_id = i.id) AS ja
+      FROM public.items i
+     WHERE i.order_id = p_order
+       AND i.product_id IS NOT NULL
+  LOOP
+    -- Servi\xE7o, n\xE3o produto: o que se executa numa cadeira.
+    CONTINUE WHEN NOT EXISTS (
+      SELECT 1 FROM public.products p
+       WHERE p.id = v_item.product_id AND p.kind = 'service');
+
+    v_faltam := greatest(0, ceil(coalesce(v_item.quantity, 1))::integer - v_item.ja::integer);
+    FOR v_k IN 1 .. v_faltam LOOP
+      INSERT INTO public.plg_clinical_sessions
+        (tenant_id, unit_id, status, booking_id, party_id, assignee_id, service_id, order_item_id, metadata)
+      VALUES
+        (a.tenant_id, a.unit_id, 'contracted', p_booking, a.party_id, a.assignee_id,
+         v_item.product_id, v_item.id,
+         jsonb_build_object('source', 'clinical_contract_services'));
+      v_total := v_total + 1;
+    END LOOP;
+  END LOOP;
+
+  RETURN v_total;
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_sessions_for_order(uuid, uuid) TO authenticated;
+
+
+CREATE OR REPLACE FUNCTION public.clinical_contract_services(p_booking uuid, p_lines jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_order uuid; v_line jsonb; v_item uuid; v_n int := 0;
+  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_marcado');
+  END IF;
+
+  -- As linhas, no formato que \`order_create\` j\xE1 entende.
+  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+  LOOP
+    v_rpc_lines := v_rpc_lines || jsonb_build_object(
+      'product_id', v_line ->> 'service_id',
+      'name', v_line ->> 'name',
+      'quantity', coalesce((v_line ->> 'quantity')::numeric, 1),
+      'unit_price', coalesce((v_line ->> 'unit_price')::numeric, 0),
+      'sort_order', v_idx);
+    v_idx := v_idx + 1;
+  END LOOP;
+
+  -- O pedido do atendimento. \`idempotency_key\` pelo agendamento: dois toques
+  -- no "Contratar" n\xE3o abrem duas contas para a mesma visita.
+  IF a.order_id IS NULL THEN
+    v_order := public.order_create(
+      p_kind => 'appointment',
+      p_lines => v_rpc_lines,
+      p_party_id => a.party_id,
+      p_unit_id => a.unit_id,
+      p_status => 'scheduled',
+      p_assignee_id => a.assignee_id,
+      p_metadata => jsonb_build_object('agenda', jsonb_build_object('booking_id', p_booking), 'source', 'clinical:contratacao'),
+      p_idempotency_key => 'clinical-contract:' || p_booking::text);
+    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = p_booking;
+  ELSE
+    -- Pedido j\xE1 existe (a agenda abriu na marca\xE7\xE3o): acrescenta o que falta.
+    v_order := a.order_id;
+    v_idx := coalesce((SELECT max(i.sort_order) + 1 FROM public.items i WHERE i.order_id = v_order), 0);
+    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
+    LOOP
+      INSERT INTO public.items (tenant_id, unit_id, order_id, product_id, name, quantity, unit_price, total, sort_order)
+      VALUES (a.tenant_id, a.unit_id, v_order, (v_line ->> 'service_id')::uuid, v_line ->> 'name',
+              coalesce((v_line ->> 'quantity')::numeric, 1),
+              coalesce((v_line ->> 'unit_price')::numeric, 0),
+              coalesce((v_line ->> 'quantity')::numeric, 1) * coalesce((v_line ->> 'unit_price')::numeric, 0),
+              v_idx);
+      v_idx := v_idx + 1;
+    END LOOP;
+  END IF;
+
+  -- Cada sess\xE3o passa a apontar a SUA linha. Sem isto o pedido cobra e o
+  -- atendimento n\xE3o sabe o que executou \u2014 e a bola "Conta do atendimento"
+  -- nunca fecha, porque \xE9 exatamente este v\xEDnculo que ela procura.
+  UPDATE public.plg_clinical_sessions cs
+     SET order_item_id = i.id,
+         status = CASE WHEN cs.status IN ('quoted', 'pending', 'scheduled') THEN 'contracted' ELSE cs.status END,
+         updated_at = now()
+    FROM public.items i
+   WHERE cs.booking_id = p_booking
+     AND cs.order_item_id IS NULL
+     AND i.order_id = v_order
+     AND i.product_id = cs.service_id
+     AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions o
+                      WHERE o.order_item_id = i.id AND o.id <> cs.id);
+  GET DIAGNOSTICS v_n = ROW_COUNT;
+
+  -- O que foi contratado e n\xE3o tinha sess\xE3o ganha a sua (018).
+  PERFORM public.clinical_sessions_for_order(p_booking, v_order);
+
+  RETURN jsonb_build_object(
+    'ok', true, 'order_id', v_order, 'sessoes_ligadas', v_n,
+    'total', (SELECT coalesce(sum(i.total), 0) FROM public.items i WHERE i.order_id = v_order),
+    'regua', public.clinical_requirements_refresh(p_booking));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_contract_services(uuid, jsonb) TO authenticated;
+`;
+var MIGRATION_019_ADIAR_E_UMA_ESCOLHA = `-- Adiar \xE9 uma escolha, e encerrar n\xE3o pode desfaz\xEA-la.
+--
+-- O "Executar neste atendimento" existe para dizer o que sai HOJE; o resto
+-- fica contratado para outro dia. Mas o \`Finalizar\` marcava como executada
+-- TODA sess\xE3o do agendamento \u2014 inclusive a que acabara de ser adiada. O
+-- servi\xE7o sumia do "a executar" da conta e a cliente ficava com um
+-- procedimento pago que ningu\xE9m fez, e que o sistema jurava ter feito.
+--
+-- O aviso de encerramento tinha o mesmo v\xEDcio: cobrava por servi\xE7os que a
+-- pessoa tinha acabado de dizer que ficariam para depois.
+--
+-- Agora as duas coisas olham para \`in_service\` \u2014 o que entrou na sala. O que
+-- est\xE1 em \`contracted\` \xE9 trabalho futuro e atravessa o encerramento intacto.
+
+CREATE OR REPLACE FUNCTION public.clinical_attendance_finish(p_booking uuid, p_force boolean DEFAULT false)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_bloqueia jsonb; v_nao_executados jsonb;
+  v_avisados int := 0; v_total numeric := 0; v_cliente text;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.status <> 'in_progress' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
+  END IF;
+
+  -- A trava de verdade: exig\xEAncia que impede TERMINAR.
+  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', r.kind, 'service_id', r.service_id)), '[]'::jsonb)
+    INTO v_bloqueia
+    FROM public.plg_clinical_requirements r
+   WHERE r.booking_id = p_booking AND r.blocks_finish AND r.status = 'pending';
+  IF jsonb_array_length(v_bloqueia) > 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'exigencia_bloqueia', 'itens', v_bloqueia);
+  END IF;
+
+  -- O aviso que n\xE3o trava: o que ENTROU NA SALA e n\xE3o foi confirmado.
+  --
+  -- "Fica para outra data" \xE9 uma escolha, n\xE3o um esquecimento: sess\xE3o em
+  -- \`contracted\` \xE9 trabalho futuro, j\xE1 na conta, e n\xE3o tem por que ser
+  -- cobrada no aviso nem executada \xE0 for\xE7a ao encerrar.
+  SELECT coalesce(jsonb_agg(p.name ORDER BY p.name), '[]'::jsonb) INTO v_nao_executados
+    FROM public.plg_clinical_sessions cs
+    JOIN public.products p ON p.id = cs.service_id
+   WHERE cs.booking_id = p_booking AND cs.status = 'in_service';
+  IF jsonb_array_length(v_nao_executados) > 0 AND NOT coalesce(p_force, false) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'servicos_nao_executados', 'itens', v_nao_executados);
+  END IF;
+
+  -- "Finalizar agora registra estes servi\xE7os como executados" \u2014 texto do V1,
+  -- e vale para os que estavam EM EXECU\xC7\xC3O. O que foi adiado continua
+  -- contratado: marc\xE1-lo executado sumiria com ele do "a executar" da conta
+  -- sem que a cliente tivesse recebido nada.
+  UPDATE public.plg_clinical_sessions
+     SET status = 'executed', ended_at = coalesce(ended_at, now()), updated_at = now()
+   WHERE booking_id = p_booking AND status = 'in_service';
+
+  UPDATE public.appointments
+     SET status = 'completed', updated_at = now()
+   WHERE id = p_booking;
+
+  -- Congela a trilha: depois de encerrado, a r\xE9gua n\xE3o se reapura.
+  PERFORM public.clinical_requirements_refresh(p_booking, true);
+
+  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = a.order_id;
+  SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
+
+  -- O BALC\xC3O ACENDE.
+  --
+  -- Quem recebe: a recep\xE7\xE3o da conta. Onde n\xE3o houver ningu\xE9m com o papel de
+  -- recep\xE7\xE3o \u2014 e \xE9 o caso do tenant migrado, com 0 membros nele \u2014, cai para
+  -- gerente e dono. Um aviso que n\xE3o chega a ningu\xE9m deixaria a conta parada
+  -- sem que nada na tela dissesse por qu\xEA.
+  WITH alvo AS (
+    SELECT m.user_id
+      FROM app.memberships m
+      JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
+       AND r.key IN ('recepcao', 'reception')
+    UNION ALL
+    SELECT m.user_id
+      FROM app.memberships m
+      JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
+       AND r.key IN ('owner', 'manager')
+       AND NOT EXISTS (
+         SELECT 1 FROM app.memberships m2 JOIN app.roles r2 ON r2.id = m2.role_id
+          WHERE m2.tenant_id = a.tenant_id AND coalesce(m2.active, true)
+            AND r2.key IN ('recepcao', 'reception'))
+  )
+  INSERT INTO public.notifications (tenant_id, user_id, title, body, type, link, subject_type, subject_id)
+  SELECT a.tenant_id, alvo.user_id,
+         'Checkout pendente',
+         coalesce(v_cliente, 'Cliente') || ' terminou o atendimento'
+           -- O dinheiro escrito como o Brasil escreve. \`to_char\` usa o
+           -- \`lc_numeric\` do BANCO para o grupo e a v\xEDrgula, e o cluster est\xE1
+           -- em C: sa\xEDa "R$ 999.00" no aviso de uma recep\xE7\xE3o brasileira. A
+           -- troca \xE9 feita \xE0 m\xE3o para n\xE3o depender de locale nenhum.
+           || CASE WHEN v_total > 0 THEN ' \xB7 R$ ' ||
+                replace(replace(replace(to_char(v_total, 'FM999G999G999D00'), ',', '\xA7'), '.', ','), '\xA7', '.')
+              ELSE '' END,
+         'checkout_pendente', '#/checkin', 'appointment', p_booking
+    FROM alvo
+  ON CONFLICT (user_id, subject_type, subject_id, type) WHERE subject_id IS NOT NULL DO NOTHING;
+  GET DIAGNOSTICS v_avisados = ROW_COUNT;
+
+  RETURN jsonb_build_object(
+    'ok', true, 'avisados', v_avisados, 'total', v_total,
+    'executados', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking AND status = 'executed'));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_attendance_finish(uuid, boolean) TO authenticated;
+`;
+var MIGRATION_020_COBRAR_UM_AGENDAMENTO_SEM_PEDIDO_LEVANTA_O_PEDIDO = `-- ============================================================================
+-- Cobrar um agendamento SEM pedido levanta o pedido primeiro
+--
+-- SINTOMA, visto na tela (23-09, Juliane): a aba Financeiro acende o vermelho
+-- do V1 ("atendimento de hoje sem cobran\xE7a levantada"), mas a conta n\xE3o
+-- oferece caminho nenhum \u2014 o agendamento veio da MIGRA\xC7\xC3O do V1 com
+-- \`order_id\` nulo, e a linha do servi\xE7o mora em \`appointment_items\`, n\xE3o em
+-- \`items\`. O V1 nunca teve esse beco: "Gerar Recebimento" l\xE1 CRIA a fatura a
+-- partir dos servi\xE7os do agendamento.
+--
+-- A tradu\xE7\xE3o para o V2 respeita o caminho \xFAnico do dinheiro: a cobran\xE7a n\xE3o
+-- escreve fatura \u2014 ela LEVANTA O PEDIDO pela porta do n\xFAcleo (\`order_create\`,
+-- a mesma que \`agenda_booking_create\` usa) com as linhas COM PRE\xC7O dos
+-- \`appointment_items\`, amarra o pedido ao agendamento e segue o fechamento
+-- normal (\`orders_raise_receivable_on_close\`).
+--
+-- Linha sem pre\xE7o n\xE3o vira pedido: revis\xE3o e avalia\xE7\xE3o gratuitas continuam
+-- sem cobran\xE7a, e a recusa \`nada_contratado\` continua falando por elas.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_checkout_charge(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_linhas int; v_total numeric; v_mov int; v_lines jsonb; v_order uuid;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.kind, ap.status, ap.order_id,
+         ap.party_id, ap.assignee_id, ap.unit_id
+    INTO a
+    FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
+  -- O agendamento de OUTRA conta n\xE3o existe para esta sess\xE3o.
+  IF a.tenant_id IS DISTINCT FROM app.current_tenant_id() THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
+  END IF;
+
+  IF a.order_id IS NULL THEN
+    -- As linhas com pre\xE7o do agendamento migrado. Sem nenhuma, n\xE3o h\xE1 o que
+    -- cobrar \u2014 e isso \xE9 um estado leg\xEDtimo (revis\xE3o, avalia\xE7\xE3o gratuita).
+    SELECT jsonb_agg(jsonb_build_object(
+             'service_id', ai.service_id,
+             'name', ai.name,
+             'quantity', 1,
+             'unit_price', ai.price,
+             'sort_order', ai.sort_order,
+             'duration_minutes', ai.duration_minutes,
+             'assignee_id', coalesce(ai.assignee_id, a.assignee_id)
+           ) ORDER BY ai.sort_order)
+      INTO v_lines
+      FROM public.appointment_items ai
+     WHERE ai.booking_id = a.id AND coalesce(ai.price, 0) > 0;
+
+    IF v_lines IS NULL THEN
+      RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
+    END IF;
+
+    v_order := public.order_create(
+      p_kind        => coalesce(a.kind, 'appointment'),
+      p_lines       => v_lines,
+      p_party_id    => a.party_id,
+      p_unit_id     => a.unit_id,
+      p_status      => 'scheduled',
+      p_assignee_id => a.assignee_id,
+      p_metadata    => jsonb_build_object('source', 'clinical_checkout_charge', 'booking_id', a.id));
+
+    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = a.id;
+    a.order_id := v_order;
+  END IF;
+
+  SELECT count(*), coalesce(sum(i.total), 0) INTO v_linhas, v_total
+    FROM public.items i WHERE i.order_id = a.order_id;
+  IF v_linhas = 0 THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
+  END IF;
+
+  -- Idempotente: o pedido j\xE1 fechado devolve o que existe, sem levantar um
+  -- segundo receb\xEDvel para a mesma visita.
+  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
+  IF v_mov > 0 THEN
+    RETURN jsonb_build_object('ok', true, 'ja_cobrado', true, 'total', v_total);
+  END IF;
+
+  UPDATE public.orders SET status = 'completed', updated_at = now()
+   WHERE id = a.order_id AND status <> 'completed';
+
+  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
+  RETURN jsonb_build_object('ok', true, 'total', v_total, 'movimentos', v_mov);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_checkout_charge(uuid) TO authenticated;
+`;
+var MIGRATION_021_AGENDAMENTO_NASCIDO_NO_V2_TAMBEM_TEM_REGUA = `-- ============================================================================
+-- O AGENDAMENTO NASCIDO NO V2 TAMB\xC9M TEM R\xC9GUA
+--
+-- O Iniciar atendimento percorre \`appointment_items\` \u2014 a linha do agendamento
+-- do V1, onde as 314 mil linhas migradas moram. S\xF3 que o Novo Agendamento do
+-- V2 grava as linhas pelo caminho do PEDIDO (\`agenda_booking_create\` \u2192
+-- \`orders\` + \`items\`), e nunca escreve \`appointment_items\`. Resultado, visto
+-- na tela em 23/09: o bot\xE3o vira "Em atendimento", e a r\xE9gua nasce VAZIA \u2014
+-- zero sess\xF5es, zero exig\xEAncias, bolas nenhuma. Todo agendamento criado pela
+-- pr\xF3pria UI do V2 ca\xEDa nisso; s\xF3 os migrados do V1 funcionavam.
+--
+-- O conserto MATERIALIZA a linha do agendamento na hora de come\xE7ar: se o
+-- agendamento tem pedido e ainda n\xE3o tem \`appointment_items\`, elas nascem das
+-- linhas do pedido \u2014 e o resto do fluxo (sess\xF5es, FK de \`booking_item_id\`,
+-- r\xE9gua, produtos por servi\xE7o) continua lendo o modelo que sempre leu.
+-- Idempotente: s\xF3 insere quando n\xE3o h\xE1 linha nenhuma para o agendamento.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
+AS $fn$
+DECLARE
+  a record; v_person uuid; v_created int := 0; v_adotadas int := 0;
+  v_item record; v_refresh jsonb; v_antiga uuid;
+BEGIN
+  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status,
+         ap.starts_at, ap.order_id
+    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
+  END IF;
+
+  v_person := public.current_person_id();
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
+  END IF;
+  IF a.assignee_id IS DISTINCT FROM v_person THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
+  END IF;
+  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
+  END IF;
+  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
+  END IF;
+
+  -- Agendamento nascido no V2: as linhas vivem no pedido. Materializa a linha
+  -- do agendamento \u2014 uma vez s\xF3 \u2014 para o resto do fluxo ter onde se pendurar.
+  IF a.order_id IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM public.appointment_items ai WHERE ai.booking_id = a.id) THEN
+    INSERT INTO public.appointment_items (
+      tenant_id, unit_id, booking_id, service_id, name, price,
+      duration_minutes, assignee_id, sort_order)
+    -- \`coalesce(product_id, service_id)\`: o \`order_create\` grava o servi\xE7o em
+    -- \`service_id\`; a edi\xE7\xE3o pela agenda grava em \`product_id\` (spine 190).
+    -- As duas gera\xE7\xF5es de linha existem no banco.
+    SELECT a.tenant_id, a.unit_id, a.id, coalesce(it.product_id, it.service_id),
+           it.name, it.unit_price,
+           it.duration_minutes, coalesce(it.assignee_id, a.assignee_id),
+           coalesce(it.sort_order, 0)
+      FROM public.items it
+     WHERE it.order_id = a.order_id;
+  END IF;
+
+  FOR v_item IN
+    SELECT ai.id, ai.service_id, ai.assignee_id
+      FROM public.appointment_items ai
+     WHERE ai.booking_id = p_booking
+  LOOP
+    -- J\xE1 existe sess\xE3o para este item? (dois toques, duas pessoas ao mesmo tempo)
+    CONTINUE WHEN EXISTS (
+      SELECT 1 FROM public.plg_clinical_sessions cs
+       WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
+
+    -- O QUE FOI COMPRADO ANTES E AINDA N\xC3O SAIU: adota em vez de criar.
+    SELECT cs.id INTO v_antiga
+      FROM public.plg_clinical_sessions cs
+     WHERE cs.tenant_id = a.tenant_id
+       AND cs.party_id = a.party_id
+       AND cs.service_id = v_item.service_id
+       AND cs.booking_id IS NULL
+       AND cs.status IN ('contracted', 'quoted', 'pending')
+     ORDER BY cs.created_at
+     LIMIT 1;
+
+    IF v_antiga IS NOT NULL THEN
+      UPDATE public.plg_clinical_sessions
+         SET booking_id = p_booking,
+             booking_item_id = v_item.id,
+             unit_id = coalesce(a.unit_id, unit_id),
+             assignee_id = coalesce(v_item.assignee_id, a.assignee_id),
+             performed_by_id = v_person,
+             status = 'in_service',
+             scheduled_for = a.starts_at,
+             started_at = coalesce(started_at, now()),
+             updated_at = now()
+       WHERE id = v_antiga;
+      v_adotadas := v_adotadas + 1;
+    ELSE
+      INSERT INTO public.plg_clinical_sessions (
+        tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
+        assignee_id, performed_by_id, service_id, scheduled_for, started_at)
+      VALUES (a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
+              coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
+              a.starts_at, now());
+      v_created := v_created + 1;
+    END IF;
+  END LOOP;
+
+  UPDATE public.appointments
+     SET status = 'in_progress', updated_at = now()
+   WHERE id = p_booking AND status <> 'in_progress';
+
+  v_refresh := public.clinical_requirements_refresh(p_booking);
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'sessoes_criadas', v_created,
+    'sessoes_adotadas', v_adotadas,
+    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
+    'regua', v_refresh);
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
+`;
+var MIGRATION_022_A_VISTA_DO_QUE_EXECUTAR_RESPEITA_A_CERCA = `-- ============================================================================
+-- THE "TO EXECUTE" VIEW READS WITH THE CALLER'S PRIVILEGES
+--
+-- \`v_clinical_to_execute\` was created in 014 without \`security_invoker\`, so it
+-- ran with the privileges of the role that OWNS it, and a view owned by a
+-- privileged role does not apply the row policies of the tables beneath it.
+-- \`plg_clinical_sessions\`, \`items\` and \`plg_financial_movements\` are all
+-- tenant-scoped with RLS; read through this view, they were not.
+--
+-- Not theoretical: the view answers, per party, how much a patient has already
+-- PAID for procedures not yet performed. Without the fence that is every
+-- clinic's prepaid balance, to anyone holding any session.
+--
+-- \u2500\u2500 why nobody saw it \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- N16 of the posture suite grades exactly this ("every public view over a
+-- tenant_id table is security_invoker"), and it stayed green throughout:
+-- plugin-clinical was never listed in \`packages/db/chain.json\`, so its objects
+-- were never built on the bench and never graded. The plugin reached a live
+-- pool on 2026-09-22 and no board at all. Putting it in the chain is what made
+-- the suite fail, on the first run, in the expected place.
+--
+-- \u2500\u2500 why a new file, and not an edit to 014 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 014 is in \`public._migrations\` on a live pool with checksum 6f04df24cdb2,
+-- and the ledger treats a changed checksum on an applied file as a HARD STOP
+-- (cli/src/lib/ledger.ts). Editing it in place would not fix the view \u2014 it
+-- would stop \`fayz db apply\` on every cluster that already ran it.
+--
+-- The body below is 014's, copied unchanged. \`CREATE OR REPLACE VIEW\` refuses
+-- a different column list, and the only thing that may differ here is who the
+-- row filter runs as.
+-- ============================================================================
+
+CREATE OR REPLACE VIEW public.v_clinical_to_execute WITH (security_invoker = true) AS
+WITH sessao AS (
+  SELECT
+    cs.tenant_id,
+    cs.party_id,
+    cs.order_item_id,
+    cs.status,
+    i.order_id,
+    coalesce(i.total, 0) AS item_total
+  FROM public.plg_clinical_sessions cs
+  JOIN public.items i ON i.id = cs.order_item_id
+  WHERE cs.party_id IS NOT NULL
+    AND cs.status IN ('contracted', 'quoted', 'in_service', 'scheduled', 'pending')
+),
+-- Quanto do PEDIDO j\xE1 foi recebido, em propor\xE7\xE3o: o pagamento \xE9 por parcela e
+-- n\xE3o por item, ent\xE3o a fatia paga de cada item \xE9 a fatia paga do pedido.
+pago AS (
+  SELECT m.invoice_id AS order_id,
+         sum(coalesce(m.paid_amount, 0)) AS pago,
+         nullif(sum(coalesce(m.amount, 0)), 0) AS total
+    FROM public.plg_financial_movements m
+   WHERE m.direction = 'credit'
+   GROUP BY m.invoice_id
+)
+SELECT
+  s.tenant_id,
+  s.party_id,
+  sum(s.item_total * coalesce(p.pago / p.total, 0))::numeric(14,2) AS paid_to_execute,
+  sum(s.item_total * (1 - coalesce(p.pago / p.total, 0)))::numeric(14,2) AS open_to_execute,
+  count(*)::int AS sessions_to_execute
+FROM sessao s
+LEFT JOIN pago p ON p.order_id = s.order_id
+GROUP BY s.tenant_id, s.party_id;
+`;
+var MIGRATIONS = [
+  { id: "001_o_atendimento_clinico_tem_onde_morar", sql: MIGRATION_001_O_ATENDIMENTO_CLINICO_TEM_ONDE_MORAR },
+  { id: "002_o_prontuario_do_v1_atravessa", sql: MIGRATION_002_O_PRONTUARIO_DO_V1_ATRAVESSA },
+  { id: "003_a_permissao_se_pergunta_por_unidade_nao_por_linha", sql: MIGRATION_003_A_PERMISSAO_SE_PERGUNTA_POR_UNIDADE_NAO_POR_LINHA },
+  { id: "004_a_regua_volta_a_ser_apurada", sql: MIGRATION_004_A_REGUA_VOLTA_A_SER_APURADA },
+  { id: "005_comecar_o_atendimento_e_um_gesto_so", sql: MIGRATION_005_COMECAR_O_ATENDIMENTO_E_UM_GESTO_SO },
+  { id: "006_contratar_nao_e_pagar", sql: MIGRATION_006_CONTRATAR_NAO_E_PAGAR },
+  { id: "007_finalizar_acende_o_balcao", sql: MIGRATION_007_FINALIZAR_ACENDE_O_BALCAO },
+  { id: "008_conferir_nao_e_receber", sql: MIGRATION_008_CONFERIR_NAO_E_RECEBER },
+  { id: "009_o_botao_de_cobrar_cobra", sql: MIGRATION_009_O_BOTAO_DE_COBRAR_COBRA },
+  { id: "010_a_indicacao_vai_para_o_funil", sql: MIGRATION_010_A_INDICACAO_VAI_PARA_O_FUNIL },
+  { id: "011_interesse_e_indicacao_na_mesma_linha", sql: MIGRATION_011_INTERESSE_E_INDICACAO_NA_MESMA_LINHA },
+  { id: "012_o_que_foi_usado_espera_aprovacao", sql: MIGRATION_012_O_QUE_FOI_USADO_ESPERA_APROVACAO },
+  { id: "013_o_que_couber_hoje", sql: MIGRATION_013_O_QUE_COUBER_HOJE },
+  { id: "014_o_pago_a_executar_deixa_de_ser_invisivel", sql: MIGRATION_014_O_PAGO_A_EXECUTAR_DEIXA_DE_SER_INVISIVEL },
+  { id: "015_a_revisao_aponta_o_que_revisa", sql: MIGRATION_015_A_REVISAO_APONTA_O_QUE_REVISA },
+  { id: "016_a_compra_antecipada_nao_tem_agendamento_atras", sql: MIGRATION_016_A_COMPRA_ANTECIPADA_NAO_TEM_AGENDAMENTO_ATRAS },
+  { id: "017_o_que_ja_foi_pago_nao_se_cobra_de_novo", sql: MIGRATION_017_O_QUE_JA_FOI_PAGO_NAO_SE_COBRA_DE_NOVO },
+  { id: "018_o_que_foi_contratado_vira_sessao", sql: MIGRATION_018_O_QUE_FOI_CONTRATADO_VIRA_SESSAO },
+  { id: "019_adiar_e_uma_escolha", sql: MIGRATION_019_ADIAR_E_UMA_ESCOLHA },
+  { id: "020_cobrar_um_agendamento_sem_pedido_levanta_o_pedido", sql: MIGRATION_020_COBRAR_UM_AGENDAMENTO_SEM_PEDIDO_LEVANTA_O_PEDIDO },
+  { id: "021_agendamento_nascido_no_v2_tambem_tem_regua", sql: MIGRATION_021_AGENDAMENTO_NASCIDO_NO_V2_TAMBEM_TEM_REGUA },
+  { id: "022_a_vista_do_que_executar_respeita_a_cerca", sql: MIGRATION_022_A_VISTA_DO_QUE_EXECUTAR_RESPEITA_A_CERCA }
+];
+
+// src/index.ts
+function createClinicalPlugin(_options = {}) {
+  return definePlugin({
+    id: "clinical",
+    name: "Prontu\xE1rio",
+    icon: "Stethoscope",
+    version: "0.1.0",
+    apiVersion: 1,
+    scope: "addon",
+    defaultEnabled: false,
+    dependencies: ["agenda"],
+    navigation: [],
+    routes: [],
+    migrations: MIGRATIONS.map((entry) => ({
+      id: `clinical-${entry.id}`,
+      version: "1.0.0",
+      sql: entry.sql,
+      description: "A sess\xE3o cl\xEDnica, o consumo de produto, as exig\xEAncias de execu\xE7\xE3o e a revis\xE3o do servi\xE7o."
+    }))
+  });
+}
+var src_default = createClinicalPlugin;
+
+export { createClinicalPlugin, src_default as default };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map