@fayz-ai/plugin-clinical 0.4.14 → 0.4.16

package/dist/index.js

@@ -1,3761 +1,8 @@
 import { tl, definePlugin } from '@fayz-ai/core';
+import { MIGRATIONS } from '#migrations/main';
 import { defineSettingsTab, attendanceSettingsParent } from '@fayz-ai/admin';
 
 // src/index.ts
-
-// src/migrations/index.ts
-var MIGRATION_001_O_ATENDIMENTO_CLINICO_TEM_ONDE_MORAR = `-- O atendimento cl\xEDnico tem onde morar.
---
--- 358.577 linhas do Espa\xE7o Facial n\xE3o tinham destino nenhum no V2 \u2014 96% de tudo
--- que ainda falta portar daquele tenant. N\xE3o era uma tabela esquecida: era um
--- DOM\xCDNIO inteiro sem casa.
---
---     journey_executions        233.934   a sess\xE3o de execu\xE7\xE3o
---     execution_products        117.011   o produto consumido na sess\xE3o
---     execution_requirements      6.590   o que trava come\xE7ar e terminar
---     service_revisions             110   a vers\xE3o do servi\xE7o (pre\xE7o, prazo)
---     service_revision_forms         87   os formul\xE1rios daquela vers\xE3o
---     prepaid_item_outcomes          30   o desfecho do item contratado
---
--- \u2500\u2500 Por que n\xE3o \xE9 a agenda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- A agenda termina em QUEM, QUANDO e ONDE \u2014 \`appointments\` e
--- \`appointment_items\`, que j\xE1 atravessaram na migration 008. O que est\xE1 aqui \xE9
--- O QUE FOI FEITO, e tem ciclo de vida pr\xF3prio: revis\xE3o com pai
--- (\`parent_execution_id\`), requisitos que bloqueiam in\xEDcio e fim, consumo de
--- produto auditado contra o estoque, foto por pose.
---
--- A jornada est\xE1 documentada em
--- ~/dev/beautyplace/docs/v1-guide/jornadas/avaliacao-e-contratacao/FLOW.md
--- (\`v2.status: missing\`): anamnese COM VALIDADE \u2192 avalia\xE7\xE3o com desenho do rosto
--- e foto \u2192 indica\xE7\xE3o com quantidade \u2192 "o que o cliente deseja contratar" \u2192
--- contrato assinado e termo de sess\xE3o \u2192 executar s\xF3 o que couber hoje \u2192 r\xE9gua de
--- etapas com cron\xF4metro e evolu\xE7\xE3o cl\xEDnica.
---
--- \xC9 capacidade de VERTICAL (est\xE9tica, sa\xFAde), n\xE3o do n\xFAcleo. Por isso plugin
--- pr\xF3prio e entrada em \`optional\` no chain.json, como o workforce.
---
--- \u2500\u2500 O que N\xC3O \xE9 deste dom\xEDnio, apesar do nome \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- \`journeys\` e \`journey_steps\` compartilham o prefixo com \`journey_executions\` e
--- n\xE3o t\xEAm rela\xE7\xE3o nenhuma com ele: ZERO chave estrangeira entre os dois, e
--- \`journey_steps\` aponta para \`message_templates\` carregando \`wait_value\`,
--- \`channel\`, \`quiet_hours_start\` e \`cooldown_days\`. \xC9 automa\xE7\xE3o de COMUNICA\xC7\xC3O,
--- e o destino dela \xE9 \`plg_automations_flows\`, que j\xE1 existe. S\xE3o 7 linhas, e a
--- tela delas no V1 nem abre (V1-027).
---
--- \u2500\u2500 As colunas que ficaram para tr\xE1s, e por qu\xEA \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- Medido no tenant 1 em 21/09/2026:
---
---   \`execution_products.stock_deducted\`     0 de 117.015 verdadeiras
---   \`execution_products.stock_movement_id\`  0 preenchidas
---   \`execution_products.stock_position_id\`  0 preenchidas
---   \`position_allocations\` / \`unit_label_allocations\`  0 preenchidas
---
--- O consumo NUNCA deu baixa no estoque neste tenant. Isso n\xE3o \xE9 defeito do
--- porte: \xE9 o que o pr\xF3prio Guia do V1 descreve na jornada
--- \`auditoria-de-uso-e-estoque\`, onde a auditoria \xE9 port\xE3o PR\xC9-baixa e a baixa
--- fica pendurada. Trazer colunas vazias faria a tela do V2 afirmar que existe um
--- v\xEDnculo com o raz\xE3o que nunca existiu. O dia em que houver baixa, ela vira
--- \`plg_inventory_stock_movements\` com \`subject_id\` apontando para a sess\xE3o.
---
---   \`journey_executions.product_id\`         0 de 233.950 \u2014 coluna morta
---   \`journey_executions.status\`             redundante com \`journey_status\`, que
---                                           \xE9 mais granular (separa quoted de
---                                           contracted). Vai para metadata.
---   \`execution_photos\` / \`consumption_photos\`  s\xE3o ARQUIVO, e arquivo no V2 \xE9
---     \`public.documents\`. S\xE3o muitos por sess\xE3o, cada um com a sua pose, ent\xE3o o
---     v\xEDnculo \xE9 \`documents.subject_type\`/\`subject_id\` \u2014 e n\xE3o uma coluna de
---     array que nenhuma RLS de arquivo alcan\xE7a.
---
--- Idempotente.
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 1. A sess\xE3o
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE TABLE IF NOT EXISTS public.plg_clinical_sessions (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    unit_id uuid,
-    -- O \`journey_status\` do V1. Fechado num CHECK porque \xE9 vocabul\xE1rio de
-    -- plugin, n\xE3o arqu\xE9tipo \u2014 \`schedule_kinds\`/\`appointment_kinds\` s\xE3o registros
-    -- de esp\xE9cie, e uma sess\xE3o cl\xEDnica n\xE3o \xE9 esp\xE9cie de nada.
-    status text DEFAULT 'pending'::text NOT NULL,
-    -- O agendamento: 226.551 de 233.950 (96,8%). Os que faltam s\xE3o sess\xE3o sem
-    -- agenda \u2014 contratada e ainda n\xE3o marcada.
-    booking_id uuid,
-    -- O item do agendamento: 2.511 de 233.950. Raro no V1 e mantido assim: o
-    -- v\xEDnculo forte com o que foi vendido \xE9 \`order_item_id\`.
-    booking_item_id uuid,
-    party_id uuid,
-    -- Quem estava marcado e quem de fato executou s\xE3o duas perguntas. O V1
-    -- guarda as duas (\`professional_id\`, \`execution_professional_id\`) e a
-    -- segunda s\xF3 existe em 148.414 \u2014 \xE9 ela que a comiss\xE3o l\xEA.
-    assignee_id uuid,
-    performed_by_id uuid,
-    service_id uuid,
-    order_item_id uuid,
-    quote_item_id uuid,
-    -- 233.281 de 233.950 (99,7%) t\xEAm oportunidade. A sess\xE3o pendura no NEG\xD3CIO
-    -- antes de pendurar na agenda, e \xE9 por isso que ela existe para o que foi
-    -- or\xE7ado e nunca marcado.
-    deal_id uuid,
-    revision_number integer DEFAULT 1 NOT NULL,
-    parent_session_id uuid,
-    source_evaluation_id uuid,
-    scheduled_for date,
-    started_at timestamp with time zone,
-    ended_at timestamp with time zone,
-    products_initialized boolean DEFAULT false NOT NULL,
-    notes text,
-    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
-    owner_id uuid,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT plg_clinical_sessions_status_check CHECK (status = ANY (ARRAY[
-      'quoted'::text, 'contracted'::text, 'scheduled'::text, 'in_service'::text,
-      'in_progress'::text, 'executed'::text, 'pending'::text])),
-    CONSTRAINT plg_clinical_sessions_revision_check CHECK (revision_number >= 1),
-    -- A sess\xE3o termina depois de come\xE7ar. O V1 n\xE3o cobra isso e por isso a
-    -- recusa vive no writer do porte, n\xE3o aqui \u2014 mas daqui para frente vale.
-    CONSTRAINT plg_clinical_sessions_window_check
-      CHECK (started_at IS NULL OR ended_at IS NULL OR ended_at >= started_at)
-);
-
-COMMENT ON TABLE public.plg_clinical_sessions IS
-  'A sess\xE3o de execu\xE7\xE3o do atendimento cl\xEDnico. V1: journey_executions \u2014 que N\xC3O tem rela\xE7\xE3o com journeys, apesar do nome.';
-COMMENT ON COLUMN public.plg_clinical_sessions.performed_by_id IS
-  'V1: execution_professional_id \u2014 quem de fato executou, que pode n\xE3o ser quem estava marcado.';
-COMMENT ON COLUMN public.plg_clinical_sessions.source_evaluation_id IS
-  'V1: source_evaluation_execution_id \u2014 a avalia\xE7\xE3o que originou esta indica\xE7\xE3o.';
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 2. O produto consumido
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE TABLE IF NOT EXISTS public.plg_clinical_session_products (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    unit_id uuid,
-    session_id uuid NOT NULL,
-    product_id uuid NOT NULL,
-    order_item_id uuid,
-    assignee_id uuid,
-    -- O "Padr\xE3o: N" da ficha t\xE9cnica contra o que a profissional realmente usou.
-    -- \xC9 a diferen\xE7a entre os dois que a auditoria de consumo l\xEA.
-    default_quantity numeric(14,4),
-    used_quantity numeric(14,4),
-    used_unit_id uuid,
-    executed_on date,
-    is_audited boolean DEFAULT false NOT NULL,
-    audited_at timestamp with time zone,
-    audited_by uuid,
-    audit_notes text,
-    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT plg_clinical_session_products_qty_check
-      CHECK (used_quantity IS NULL OR used_quantity >= 0)
-);
-
-COMMENT ON TABLE public.plg_clinical_session_products IS
-  'O produto consumido na sess\xE3o, com o padr\xE3o da ficha t\xE9cnica ao lado do usado. V1: execution_products. As colunas de baixa de estoque n\xE3o vieram: 0 de 117.015 estavam preenchidas.';
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 3. O que trava come\xE7ar e terminar
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE TABLE IF NOT EXISTS public.plg_clinical_requirements (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    unit_id uuid,
-    session_id uuid,
-    booking_id uuid,
-    party_id uuid,
-    service_id uuid,
-    kind text NOT NULL,
-    scope text NOT NULL,
-    -- As duas travas do V1, e elas s\xE3o diferentes: a anamnese impede COME\xC7AR, o
-    -- termo de sess\xE3o impede TERMINAR. 1.107 e 1.023 linhas no tenant 1.
-    blocks_start boolean DEFAULT false NOT NULL,
-    blocks_finish boolean DEFAULT false NOT NULL,
-    status text DEFAULT 'pending'::text NOT NULL,
-    -- O que resolveu a exig\xEAncia \xE9 polim\xF3rfico no V1 (\`resolved_table\` +
-    -- \`resolved_id\`) e continua sendo aqui, com o mesmo par que
-    -- \`public.documents\` j\xE1 usa. Um formul\xE1rio resolve por uma linha de
-    -- plg_forms_documents; um contrato, por outra.
-    subject_type text,
-    subject_id uuid,
-    candidate_type text,
-    candidate_id uuid,
-    resolved_via text,
-    resolved_at timestamp with time zone,
-    -- A anamnese vale at\xE9 uma data ("V\xE1lido at\xE9 08/03/2027"), e \xE9 isso que
-    -- solta o resto da r\xE9gua.
-    valid_until timestamp with time zone,
-    frozen_at timestamp with time zone,
-    rule_sources jsonb DEFAULT '[]'::jsonb NOT NULL,
-    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT plg_clinical_requirements_kind_check CHECK (kind = ANY (ARRAY[
-      'form'::text, 'evaluation'::text, 'contract'::text, 'session_term'::text,
-      'products'::text, 'invoice_item'::text, 'revision_link'::text])),
-    CONSTRAINT plg_clinical_requirements_scope_check
-      CHECK (scope = ANY (ARRAY['service'::text, 'attendance'::text])),
-    CONSTRAINT plg_clinical_requirements_status_check CHECK (status = ANY (ARRAY[
-      'pending'::text, 'resolved'::text, 'not_applicable'::text]))
-);
-
-COMMENT ON TABLE public.plg_clinical_requirements IS
-  'A exig\xEAncia que trava o in\xEDcio ou o fim do atendimento \u2014 anamnese, avalia\xE7\xE3o, contrato, termo, kit. V1: execution_requirements.';
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 4. A vers\xE3o do servi\xE7o
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- O servi\xE7o muda de pre\xE7o e de prazo, e o que foi contratado tem de continuar
--- valendo o que valia. A revis\xE3o \xE9 o congelamento \u2014 e ela carrega os
--- formul\xE1rios que aquela vers\xE3o exigia.
-CREATE TABLE IF NOT EXISTS public.plg_clinical_service_revisions (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    service_id uuid NOT NULL,
-    revision_number integer NOT NULL,
-    price numeric(14,2),
-    duration_minutes integer,
-    deadline_days integer,
-    -- Os \`service_revision_forms\` daquela revis\xE3o. S\xE3o 87 linhas em 110
-    -- revis\xF5es: uma lista curta, sem vida pr\xF3pria e sem tela \u2014 jsonb em vez de
-    -- uma quarta tabela que ningu\xE9m consulta sozinha.
-    form_template_refs jsonb DEFAULT '[]'::jsonb NOT NULL,
-    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT plg_clinical_service_revisions_number_check CHECK (revision_number >= 1)
-);
-
-COMMENT ON TABLE public.plg_clinical_service_revisions IS
-  'A vers\xE3o congelada do servi\xE7o \u2014 pre\xE7o, dura\xE7\xE3o e prazo no momento da contrata\xE7\xE3o. V1: service_revisions + service_revision_forms.';
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 5. O desfecho do que foi contratado e n\xE3o executado
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE TABLE IF NOT EXISTS public.plg_clinical_prepaid_outcomes (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    unit_id uuid,
-    booking_id uuid,
-    order_item_id uuid,
-    outcome text NOT NULL,
-    reason text,
-    decided_by uuid,
-    decided_at timestamp with time zone DEFAULT now() NOT NULL,
-    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT plg_clinical_prepaid_outcomes_check CHECK (outcome = ANY (ARRAY[
-      'contracted'::text, 'declined'::text, 'postponed'::text]))
-);
-
-COMMENT ON TABLE public.plg_clinical_prepaid_outcomes IS
-  'O que aconteceu com o servi\xE7o contratado e n\xE3o executado no dia \u2014 contratado, recusado ou adiado. V1: prepaid_item_outcomes.';
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 6. As chaves
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- Toda FK para uma tabela escopada por unidade \xE9 COMPOSTA (tenant_id, id): \xE9
--- ela que impede a sess\xE3o de uma casa apontar para o agendamento de outra. Onde
--- a refer\xEAncia \xE9 opcional, \`ON DELETE SET NULL\` \u2014 apagar o agendamento n\xE3o pode
--- levar o prontu\xE1rio junto.
-DO $$
-DECLARE
-  t text;
-  tabelas text[] := ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
-                          'plg_clinical_requirements', 'plg_clinical_service_revisions',
-                          'plg_clinical_prepaid_outcomes'];
-BEGIN
-  FOREACH t IN ARRAY tabelas LOOP
-    IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                    WHERE conrelid = ('public.' || t)::regclass AND contype = 'p') THEN
-      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I PRIMARY KEY (id)', t, t || '_pkey');
-    END IF;
-    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_id_id_key') THEN
-      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I UNIQUE (tenant_id, id)', t, t || '_tenant_id_id_key');
-    END IF;
-    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_fkey') THEN
-      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE', t, t || '_tenant_fkey');
-    END IF;
-  END LOOP;
-END $$;
-
-DO $$ BEGIN
-  -- sess\xF5es
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_unit_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_unit_fkey
-      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_booking_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_booking_fkey
-      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_booking_item_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_booking_item_fkey
-      FOREIGN KEY (booking_item_id) REFERENCES public.appointment_items(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_party_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_party_fkey
-      FOREIGN KEY (party_id) REFERENCES public.people(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_assignee_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_assignee_fkey
-      FOREIGN KEY (assignee_id) REFERENCES public.people(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_performed_by_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_performed_by_fkey
-      FOREIGN KEY (performed_by_id) REFERENCES public.people(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_service_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_service_fkey
-      FOREIGN KEY (service_id) REFERENCES public.products(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_order_item_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_order_item_fkey
-      FOREIGN KEY (order_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_quote_item_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_quote_item_fkey
-      FOREIGN KEY (quote_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
-  END IF;
-  -- O pai e a avalia\xE7\xE3o de origem s\xE3o a MESMA tabela. CASCADE aqui apagaria a
-  -- corrente de revis\xF5es inteira ao apagar a primeira; SET NULL deixa as filhas
-  -- \xF3rf\xE3s e leg\xEDveis, que \xE9 o que um prontu\xE1rio pede.
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_parent_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_parent_fkey
-      FOREIGN KEY (parent_session_id) REFERENCES public.plg_clinical_sessions(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_sessions_source_eval_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_sessions ADD CONSTRAINT plg_clinical_sessions_source_eval_fkey
-      FOREIGN KEY (source_evaluation_id) REFERENCES public.plg_clinical_sessions(id) ON DELETE SET NULL;
-  END IF;
-
-  -- produtos da sess\xE3o: a sess\xE3o some, o consumo some junto \u2014 ele n\xE3o existe fora dela
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_session_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_session_fkey
-      FOREIGN KEY (tenant_id, session_id) REFERENCES public.plg_clinical_sessions(tenant_id, id) ON DELETE CASCADE;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_product_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_product_fkey
-      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_session_products_unit_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_session_products ADD CONSTRAINT plg_clinical_session_products_unit_fkey
-      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
-  END IF;
-  -- A UNIDADE DE MEDIDA (SR, UI, mL) MORA NO ESTOQUE, E FICA SEM CHAVE.
-  --
-  -- Havia uma FK para \`plg_inventory_measurement_units\`. Ela amarra dois ciclos
-  -- de release e torna imposs\xEDvel desinstalar o estoque sem derrubar o
-  -- prontu\xE1rio \u2014 a cl\xEDnica que n\xE3o usa estoque passaria a precisar dele. O
-  -- \`used_unit_id\` continua sendo o uuid de l\xE1; quem quiser o s\xEDmbolo resolve
-  -- na leitura, e unidade apagada vira n\xFAmero sem r\xF3tulo em vez de escrita
-  -- recusada.
-  ALTER TABLE public.plg_clinical_session_products
-    DROP CONSTRAINT IF EXISTS plg_clinical_session_products_uom_fkey;
-
-  -- exig\xEAncias
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_session_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_session_fkey
-      FOREIGN KEY (tenant_id, session_id) REFERENCES public.plg_clinical_sessions(tenant_id, id) ON DELETE CASCADE;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_booking_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_booking_fkey
-      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE CASCADE;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_requirements_unit_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_requirements ADD CONSTRAINT plg_clinical_requirements_unit_fkey
-      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
-  END IF;
-
-  -- revis\xE3o do servi\xE7o: uma por (servi\xE7o, n\xFAmero)
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_service_revisions_service_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_service_revisions ADD CONSTRAINT plg_clinical_service_revisions_service_fkey
-      FOREIGN KEY (service_id) REFERENCES public.products(id) ON DELETE CASCADE;
-  END IF;
-
-  -- desfecho
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_booking_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_booking_fkey
-      FOREIGN KEY (booking_id) REFERENCES public.appointments(id) ON DELETE CASCADE;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_item_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_item_fkey
-      FOREIGN KEY (order_item_id) REFERENCES public.items(id) ON DELETE SET NULL;
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_clinical_prepaid_outcomes_unit_fkey') THEN
-    ALTER TABLE ONLY public.plg_clinical_prepaid_outcomes ADD CONSTRAINT plg_clinical_prepaid_outcomes_unit_fkey
-      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
-  END IF;
-END $$;
-
-CREATE UNIQUE INDEX IF NOT EXISTS plg_clinical_service_revisions_service_number_key
-  ON public.plg_clinical_service_revisions USING btree (tenant_id, service_id, revision_number);
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 7. Os \xEDndices das tr\xEAs perguntas que a tela faz
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- "o que aconteceu com esta paciente" \xB7 "o que falta neste atendimento" \xB7
--- "quanto deste produto saiu". Com 233 mil sess\xF5es numa rede de 63 unidades,
--- cada uma dessas sem \xEDndice \xE9 uma varredura.
-CREATE INDEX IF NOT EXISTS plg_clinical_sessions_party_idx
-  ON public.plg_clinical_sessions USING btree (tenant_id, party_id, scheduled_for DESC);
-CREATE INDEX IF NOT EXISTS plg_clinical_sessions_booking_idx
-  ON public.plg_clinical_sessions USING btree (tenant_id, booking_id) WHERE booking_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS plg_clinical_sessions_unit_status_idx
-  ON public.plg_clinical_sessions USING btree (tenant_id, unit_id, status, scheduled_for DESC);
-CREATE INDEX IF NOT EXISTS plg_clinical_sessions_deal_idx
-  ON public.plg_clinical_sessions USING btree (tenant_id, deal_id) WHERE deal_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS plg_clinical_session_products_session_idx
-  ON public.plg_clinical_session_products USING btree (tenant_id, session_id);
-CREATE INDEX IF NOT EXISTS plg_clinical_session_products_product_idx
-  ON public.plg_clinical_session_products USING btree (tenant_id, product_id, executed_on DESC);
-CREATE INDEX IF NOT EXISTS plg_clinical_requirements_session_idx
-  ON public.plg_clinical_requirements USING btree (tenant_id, session_id, status);
-CREATE INDEX IF NOT EXISTS plg_clinical_requirements_booking_pending_idx
-  ON public.plg_clinical_requirements USING btree (tenant_id, booking_id)
-  WHERE status = 'pending'::text;
-
-DO $$
-DECLARE t text;
-BEGIN
-  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
-                           'plg_clinical_requirements', 'plg_clinical_service_revisions',
-                           'plg_clinical_prepaid_outcomes'] LOOP
-    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', t || '_updated_at', t);
-    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()', t || '_updated_at', t);
-  END LOOP;
-END $$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 8. Quem enxerga o prontu\xE1rio
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- Escopo de UNIDADE nas quatro tabelas que t\xEAm unidade, e permiss\xE3o pr\xF3pria:
--- \`clinical.read\` n\xE3o \xE9 \`agenda.read\`. Quem marca hor\xE1rio n\xE3o l\xEA anamnese.
---
--- A revis\xE3o do servi\xE7o \xE9 a exce\xE7\xE3o: ela \xE9 do CAT\xC1LOGO, n\xE3o de uma filial \u2014 o
--- pre\xE7o congelado de um servi\xE7o vale na rede inteira, e escond\xEA-lo por unidade
--- faria a fatura de ontem virar um n\xFAmero sem origem.
--- As cinco, uma a uma e por extenso. O la\xE7o abaixo j\xE1 liga tudo isto \u2014 mas ele
--- liga por \`EXECUTE format(...)\`, e o port\xE3o que revisa plugin l\xEA o ARQUIVO,
--- n\xE3o o banco: para ele, tabela com tenant_id e sem um ENABLE literal \xE9 tabela
--- aberta. Uma garantia que o revisor n\xE3o consegue ler \xE9 uma garantia que
--- ningu\xE9m confere.
-ALTER TABLE public.plg_clinical_sessions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.plg_clinical_session_products ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.plg_clinical_requirements ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.plg_clinical_service_revisions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.plg_clinical_prepaid_outcomes ENABLE ROW LEVEL SECURITY;
-
-DO $$
-DECLARE
-  t text;
-  unidade boolean;
-BEGIN
-  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
-                           'plg_clinical_requirements', 'plg_clinical_service_revisions',
-                           'plg_clinical_prepaid_outcomes'] LOOP
-    unidade := t <> 'plg_clinical_service_revisions';
-    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', t);
-    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
-    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO authenticated', t);
-    EXECUTE format('GRANT ALL ON TABLE public.%I TO service_role', t);
-
-    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_select', t);
-    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (%s)
-        AND (SELECT app.has_permission('clinical.read', %s)))$f$,
-      t || '_authz_select', t,
-      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
-      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
-
-    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_insert', t);
-    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR INSERT TO authenticated WITH CHECK (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (%s)
-        AND (SELECT app.has_permission('clinical.create', %s)))$f$,
-      t || '_authz_insert', t,
-      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
-      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
-
-    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_update', t);
-    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR UPDATE TO authenticated USING (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (%s)
-        AND (SELECT app.has_permission('clinical.edit', %s)))
-      WITH CHECK (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (SELECT app.has_permission('clinical.edit', %s)))$f$,
-      t || '_authz_update', t,
-      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
-      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END,
-      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
-
-    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_delete', t);
-    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR DELETE TO authenticated USING (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (%s)
-        AND (SELECT app.has_permission('clinical.delete', %s)))$f$,
-      t || '_authz_delete', t,
-      CASE WHEN unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
-      CASE WHEN unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
-  END LOOP;
-END $$;
-
--- \`owner_id\` s\xF3 na sess\xE3o, e \`shareable\` falso: um prontu\xE1rio n\xE3o se compartilha
--- por tupla \u2014 ou a pessoa atende naquela unidade, ou n\xE3o l\xEA.
-INSERT INTO public.scoped_resources (resource_table, unit_column, owner_column, shareable, default_visibility, label)
-VALUES ('plg_clinical_sessions', 'unit_id', 'owner_id', false, 'unit', 'Atendimentos cl\xEDnicos')
-ON CONFLICT (resource_table) DO UPDATE
-  SET unit_column = EXCLUDED.unit_column, default_visibility = EXCLUDED.default_visibility, label = EXCLUDED.label;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 9. A permiss\xE3o existe antes da pol\xEDtica precisar dela
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- \`clinical.read\` n\xE3o \xE9 \`agenda.read\`, e a diferen\xE7a \xE9 o ponto: a recep\xE7\xE3o marca
--- hor\xE1rio e N\xC3O l\xEA anamnese. Quem hoje tem \`agenda.*\` num papel herda o
--- equivalente cl\xEDnico, porque \xE9 quem atende \u2014 e quem quiser separar recep\xE7\xE3o de
--- profissional tira a linha do papel, que \xE9 uma decis\xE3o de uma tela, n\xE3o de uma
--- migration.
-INSERT INTO app.permissions (key, plugin, description, owner_only) VALUES
-  ('clinical.read',     'clinical', 'Prontu\xE1rio: ler o atendimento, a anamnese e o consumo', false),
-  ('clinical.read_all', 'clinical', 'Prontu\xE1rio: ler o de todas as unidades',                false),
-  ('clinical.create',   'clinical', 'Prontu\xE1rio: abrir sess\xE3o e registrar consumo',          false),
-  ('clinical.edit',     'clinical', 'Prontu\xE1rio: corrigir sess\xE3o, consumo e exig\xEAncia',      false),
-  ('clinical.delete',   'clinical', 'Prontu\xE1rio: apagar',                                    false),
-  ('clinical.manage',   'clinical', 'Prontu\xE1rio: administrar',                               false)
-ON CONFLICT (key) DO UPDATE SET plugin = EXCLUDED.plugin, description = EXCLUDED.description;
-
-INSERT INTO app.role_permissions (tenant_id, role_id, permission)
-SELECT rp.tenant_id, rp.role_id, replace(rp.permission, 'agenda.', 'clinical.')
-  FROM app.role_permissions rp
- WHERE rp.permission IN ('agenda.read', 'agenda.read_all', 'agenda.create',
-                         'agenda.edit', 'agenda.delete', 'agenda.manage')
-ON CONFLICT DO NOTHING;
-`;
-var MIGRATION_002_O_PRONTUARIO_DO_V1_ATRAVESSA = `-- O prontu\xE1rio do V1 atravessa.
---
--- A 001 fez as cinco tabelas. Esta faz o TRANSPORTE: os writers do motor de
--- porte e as cinco linhas do de-para. Sem ela as tabelas existem vazias.
---
---     journey_executions        233.934 \u2192 plg_clinical_sessions
---     execution_products        117.011 \u2192 plg_clinical_session_products
---     execution_requirements      6.590 \u2192 plg_clinical_requirements
---     service_revisions             110 \u2192 plg_clinical_service_revisions
---     service_revision_forms         87 \u2192 (jsonb da revis\xE3o)
---     prepaid_item_outcomes          30 \u2192 plg_clinical_prepaid_outcomes
---
--- \u2500\u2500 Duas tabelas do V1 n\xE3o t\xEAm \`uuid\` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- \`execution_requirements\` e \`prepaid_item_outcomes\` n\xE3o guardam uuid nenhum \u2014
--- s\xF3 o id num\xE9rico. O motor j\xE1 sabe lidar com isso (o id do destino nasce
--- determin\xEDstico da chave da origem), e \xE9 por isso que o de-para delas n\xE3o
--- mapeia \`uuid\`.
---
--- \u2500\u2500 A refer\xEAncia polim\xF3rfica, resolvida em tempo de escrita \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- \`execution_requirements.resolved_table\` + \`resolved_id\` apontam para uma
--- tabela QUALQUER, e o \`@tabela\` do de-para \xE9 est\xE1tico. Ent\xE3o quem resolve \xE9 o
--- writer, lendo o ledger com o nome da tabela que chegou na linha. Medido no
--- tenant 1:
---
---     client_form_responses   2.685   ainda n\xE3o migrou \u2192 fica NULO, com o
---                                     n\xFAmero cru em metadata
---     journey_executions      1.048   resolve
---     generated_contracts       845   ainda n\xE3o migrou
---     invoice_items             423   resolve
---     appointments               80   resolve
---
--- O n\xFAmero cru fica em \`metadata.clinical.v1_resolved_ref\` de prop\xF3sito: no dia
--- em que \`client_form_responses\` atravessar, uma passada de costura preenche os
--- 2.685 sem reler a origem \u2014 foi o que a 011 da agenda fez com a sala.
---
--- \u2500\u2500 A revis\xE3o e os formul\xE1rios dela \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- 87 linhas de \`service_revision_forms\` em 110 revis\xF5es. Uma lista curta, sem
--- tela e sem vida pr\xF3pria, ent\xE3o ela entra como jsonb DENTRO da revis\xE3o \u2014 e o
--- writer que a escreve \xE9 um facet: acha a revis\xE3o pelo ledger e acrescenta,
--- sem duplicar quando a onda roda de novo.
---
--- Idempotente.
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 1. O vocabul\xE1rio fechado aprende quatro palavras
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- Por ACR\xC9SCIMO, lendo a defini\xE7\xE3o vigente. Lista literal apaga o que um passo
--- anterior acrescentou \u2014 \xE9 a armadilha registrada em financial/072 e agenda/008.
-DO $$
-DECLARE v_def text;
-BEGIN
-  SELECT pg_get_constraintdef(oid) INTO v_def
-    FROM pg_constraint WHERE conname = 'allowlist_writer_check';
-  IF v_def IS NULL OR strpos(v_def, 'clinical_session') > 0 THEN RETURN; END IF;
-  ALTER TABLE migration.allowlist DROP CONSTRAINT allowlist_writer_check;
-  EXECUTE replace(
-    'ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check ' || v_def,
-    '''person''::text',
-    '''person''::text, ''clinical_session''::text, ''clinical_session_product''::text, '
-    '''clinical_requirement''::text, ''clinical_service_revision''::text, '
-    '''clinical_revision_form''::text, ''clinical_prepaid_outcome''::text');
-END $$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 2. Uma ajuda: resolver refer\xEAncia polim\xF3rfica pelo ledger
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
---
--- SECURITY DEFINER porque l\xEA \`migration.ledger\`, que o papel do porte j\xE1
--- alcan\xE7a mas nenhuma pol\xEDtica de tenant descreve. Devolve NULO quando a linha
--- de origem ainda n\xE3o atravessou \u2014 e NULO aqui \xE9 resposta, n\xE3o erro.
-CREATE OR REPLACE FUNCTION migration._clinical_resolve(
-  p_tenant uuid, p_table text, p_id text
-) RETURNS uuid
-LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
-AS $function$
-  SELECT l.target_id
-    FROM migration.ledger l
-   WHERE l.tenant_id = p_tenant
-     AND l.source_table = p_table
-     AND l.status = 'migrated'
-     AND l.source_numeric_id = nullif(p_id, '')::bigint
-   LIMIT 1
-$function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 3. O writer da sess\xE3o
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_session(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_status     text  := nullif(p_row ->> 'status', '');
-  v_unit       uuid;
-  v_existing   uuid;
-  v_created    boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a clinical session needs an id');
-  END IF;
-
-  -- O vocabul\xE1rio \xE9 fechado na tabela. Recusar aqui, com a palavra na m\xE3o, \xE9
-  -- melhor do que deixar a CHECK derrubar o lote sem dizer qual linha.
-  IF v_status IS NULL OR v_status NOT IN ('quoted','contracted','scheduled','in_service','in_progress','executed','pending') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('clinical session status %L is not one of the seven the V1 writes', v_status));
-  END IF;
-
-  BEGIN v_unit := (p_row ->> 'unit_id')::uuid; EXCEPTION WHEN OTHERS THEN v_unit := NULL; END;
-  -- Sem unidade na linha, a do agendamento serve: \xE9 o mesmo atendimento.
-  IF v_unit IS NULL AND (p_row ->> 'booking_id') IS NOT NULL THEN
-    SELECT a.unit_id INTO v_unit FROM public.appointments a
-     WHERE a.id = (p_row ->> 'booking_id')::uuid AND a.tenant_id = p_tenant;
-  END IF;
-
-  SELECT tenant_id INTO v_existing FROM public.plg_clinical_sessions WHERE id = p_id;
-  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
-      'reason', format('clinical session %s already exists in another tenant', p_id));
-  END IF;
-
-  IF v_existing IS NULL THEN
-    INSERT INTO public.plg_clinical_sessions
-      (id, tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
-       assignee_id, performed_by_id, service_id, order_item_id, quote_item_id, deal_id,
-       revision_number, parent_session_id, source_evaluation_id,
-       scheduled_for, started_at, ended_at, products_initialized, notes,
-       metadata, created_at, updated_at)
-    VALUES
-      (p_id, p_tenant, v_unit, v_status,
-       nullif(p_row ->> 'booking_id', '')::uuid,
-       nullif(p_row ->> 'booking_item_id', '')::uuid,
-       nullif(p_row ->> 'party_id', '')::uuid,
-       nullif(p_row ->> 'assignee_id', '')::uuid,
-       nullif(p_row ->> 'performed_by_id', '')::uuid,
-       nullif(p_row ->> 'service_id', '')::uuid,
-       nullif(p_row ->> 'order_item_id', '')::uuid,
-       nullif(p_row ->> 'quote_item_id', '')::uuid,
-       nullif(p_row ->> 'deal_id', '')::uuid,
-       greatest(coalesce(nullif(p_row ->> 'revision_number', '')::integer, 1), 1),
-       nullif(p_row ->> 'parent_session_id', '')::uuid,
-       nullif(p_row ->> 'source_evaluation_id', '')::uuid,
-       nullif(p_row ->> 'scheduled_for', '')::date,
-       nullif(p_row ->> 'started_at', '')::timestamptz,
-       nullif(p_row ->> 'ended_at', '')::timestamptz,
-       coalesce((p_row ->> 'products_initialized')::boolean, false),
-       p_row ->> 'notes', v_meta,
-       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
-       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_clinical_sessions SET
-      unit_id              = coalesce(v_unit, unit_id),
-      status               = v_status,
-      booking_id           = coalesce(nullif(p_row ->> 'booking_id', '')::uuid, booking_id),
-      booking_item_id      = coalesce(nullif(p_row ->> 'booking_item_id', '')::uuid, booking_item_id),
-      party_id             = coalesce(nullif(p_row ->> 'party_id', '')::uuid, party_id),
-      assignee_id          = coalesce(nullif(p_row ->> 'assignee_id', '')::uuid, assignee_id),
-      performed_by_id      = coalesce(nullif(p_row ->> 'performed_by_id', '')::uuid, performed_by_id),
-      service_id           = coalesce(nullif(p_row ->> 'service_id', '')::uuid, service_id),
-      order_item_id        = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
-      quote_item_id        = coalesce(nullif(p_row ->> 'quote_item_id', '')::uuid, quote_item_id),
-      deal_id              = coalesce(nullif(p_row ->> 'deal_id', '')::uuid, deal_id),
-      parent_session_id    = coalesce(nullif(p_row ->> 'parent_session_id', '')::uuid, parent_session_id),
-      source_evaluation_id = coalesce(nullif(p_row ->> 'source_evaluation_id', '')::uuid, source_evaluation_id),
-      scheduled_for        = nullif(p_row ->> 'scheduled_for', '')::date,
-      started_at           = nullif(p_row ->> 'started_at', '')::timestamptz,
-      ended_at             = nullif(p_row ->> 'ended_at', '')::timestamptz,
-      products_initialized = coalesce((p_row ->> 'products_initialized')::boolean, products_initialized),
-      notes                = CASE WHEN p_row ? 'notes' THEN p_row ->> 'notes' ELSE notes END,
-      metadata             = migration._merge_meta(metadata, v_meta),
-      updated_at           = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
-    WHERE id = p_id;
-  END IF;
-
-  PERFORM migration._set_unit('public.plg_clinical_sessions', p_id, v_unit);
-  IF v_standalone THEN
-    PERFORM migration._audit(p_tenant, 'public.plg_clinical_sessions', p_id,
-      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
-  END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
-    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 4. O writer do produto consumido
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_session_product(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_session    uuid;
-  v_product    uuid;
-  v_unit       uuid;
-  v_existing   uuid;
-  v_created    boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a session product needs an id');
-  END IF;
-
-  BEGIN v_session := (p_row ->> 'session_id')::uuid; EXCEPTION WHEN OTHERS THEN v_session := NULL; END;
-  BEGIN v_product := (p_row ->> 'product_id')::uuid; EXCEPTION WHEN OTHERS THEN v_product := NULL; END;
-  -- Consumo sem sess\xE3o \xE9 consumo que nenhuma tela alcan\xE7a; sem produto \xE9 uma
-  -- quantidade de nada. Os dois s\xE3o recusa de FK, e a 2\xAA passada do motor os
-  -- reapresenta depois que a sess\xE3o migrar.
-  IF v_session IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', 'a session product needs the session it was used in');
-  END IF;
-  IF v_product IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', 'a session product needs the product that was used');
-  END IF;
-
-  SELECT s.unit_id INTO v_unit FROM public.plg_clinical_sessions s
-   WHERE s.id = v_session AND s.tenant_id = p_tenant;
-
-  SELECT tenant_id INTO v_existing FROM public.plg_clinical_session_products WHERE id = p_id;
-  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
-      'reason', format('session product %s already exists in another tenant', p_id));
-  END IF;
-
-  IF v_existing IS NULL THEN
-    INSERT INTO public.plg_clinical_session_products
-      (id, tenant_id, unit_id, session_id, product_id, order_item_id, assignee_id,
-       default_quantity, used_quantity, used_unit_id, executed_on,
-       is_audited, audited_at, audit_notes, metadata, created_at, updated_at)
-    VALUES
-      (p_id, p_tenant, v_unit, v_session, v_product,
-       nullif(p_row ->> 'order_item_id', '')::uuid,
-       nullif(p_row ->> 'assignee_id', '')::uuid,
-       nullif(p_row ->> 'default_quantity', '')::numeric,
-       nullif(p_row ->> 'used_quantity', '')::numeric,
-       nullif(p_row ->> 'used_unit_id', '')::uuid,
-       nullif(p_row ->> 'executed_on', '')::date,
-       coalesce((p_row ->> 'is_audited')::boolean, false),
-       nullif(p_row ->> 'audited_at', '')::timestamptz,
-       p_row ->> 'audit_notes', v_meta,
-       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
-       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_clinical_session_products SET
-      unit_id          = coalesce(v_unit, unit_id),
-      session_id       = v_session,
-      product_id       = v_product,
-      order_item_id    = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
-      assignee_id      = coalesce(nullif(p_row ->> 'assignee_id', '')::uuid, assignee_id),
-      default_quantity = nullif(p_row ->> 'default_quantity', '')::numeric,
-      used_quantity    = nullif(p_row ->> 'used_quantity', '')::numeric,
-      used_unit_id     = coalesce(nullif(p_row ->> 'used_unit_id', '')::uuid, used_unit_id),
-      executed_on      = nullif(p_row ->> 'executed_on', '')::date,
-      is_audited       = coalesce((p_row ->> 'is_audited')::boolean, is_audited),
-      audited_at       = nullif(p_row ->> 'audited_at', '')::timestamptz,
-      audit_notes      = CASE WHEN p_row ? 'audit_notes' THEN p_row ->> 'audit_notes' ELSE audit_notes END,
-      metadata         = migration._merge_meta(metadata, v_meta),
-      updated_at       = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
-    WHERE id = p_id;
-  END IF;
-
-  IF v_standalone THEN
-    PERFORM migration._audit(p_tenant, 'public.plg_clinical_session_products', p_id,
-      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
-  END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
-    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 5. O writer da exig\xEAncia
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_requirement(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_kind       text  := nullif(p_row ->> 'kind', '');
-  v_scope      text  := nullif(p_row ->> 'scope', '');
-  v_status     text  := coalesce(nullif(p_row ->> 'status', ''), 'pending');
-  v_session    uuid;
-  v_unit       uuid;
-  v_subj_t     text  := nullif(p_row ->> 'subject_type', '');
-  v_cand_t     text  := nullif(p_row ->> 'candidate_type', '');
-  v_subj_id    uuid;
-  v_cand_id    uuid;
-  v_existing   uuid;
-  v_created    boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a requirement needs an id');
-  END IF;
-  IF v_kind IS NULL OR v_kind NOT IN ('form','evaluation','contract','session_term','products','invoice_item','revision_link') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('requirement kind %L is not one of the seven the V1 writes', v_kind));
-  END IF;
-  IF v_scope IS NULL OR v_scope NOT IN ('service','attendance') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('requirement scope %L is neither service nor attendance', v_scope));
-  END IF;
-  IF v_status NOT IN ('pending','resolved','not_applicable') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('requirement status %L is not a status the V1 writes', v_status));
-  END IF;
-
-  BEGIN v_session := (p_row ->> 'session_id')::uuid; EXCEPTION WHEN OTHERS THEN v_session := NULL; END;
-  IF v_session IS NOT NULL THEN
-    SELECT s.unit_id INTO v_unit FROM public.plg_clinical_sessions s
-     WHERE s.id = v_session AND s.tenant_id = p_tenant;
-  END IF;
-
-  -- A refer\xEAncia polim\xF3rfica: o de-para n\xE3o alcan\xE7a, o ledger sim. Quando a
-  -- tabela apontada ainda n\xE3o atravessou o resultado \xE9 NULO \u2014 e o n\xFAmero cru
-  -- fica no metadata para a costura de depois.
-  v_subj_id := migration._clinical_resolve(p_tenant, v_subj_t, p_row ->> 'v1_resolved_ref');
-  v_cand_id := migration._clinical_resolve(p_tenant, v_cand_t, p_row ->> 'v1_candidate_ref');
-
-  SELECT tenant_id INTO v_existing FROM public.plg_clinical_requirements WHERE id = p_id;
-  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
-      'reason', format('requirement %s already exists in another tenant', p_id));
-  END IF;
-
-  IF v_existing IS NULL THEN
-    INSERT INTO public.plg_clinical_requirements
-      (id, tenant_id, unit_id, session_id, booking_id, party_id, service_id,
-       kind, scope, blocks_start, blocks_finish, status,
-       subject_type, subject_id, candidate_type, candidate_id,
-       resolved_via, resolved_at, valid_until, frozen_at, rule_sources,
-       metadata, created_at, updated_at)
-    VALUES
-      (p_id, p_tenant, v_unit, v_session,
-       nullif(p_row ->> 'booking_id', '')::uuid,
-       nullif(p_row ->> 'party_id', '')::uuid,
-       nullif(p_row ->> 'service_id', '')::uuid,
-       v_kind, v_scope,
-       coalesce((p_row ->> 'blocks_start')::boolean, false),
-       coalesce((p_row ->> 'blocks_finish')::boolean, false),
-       v_status, v_subj_t, v_subj_id, v_cand_t, v_cand_id,
-       nullif(p_row ->> 'resolved_via', ''),
-       nullif(p_row ->> 'resolved_at', '')::timestamptz,
-       nullif(p_row ->> 'valid_until', '')::timestamptz,
-       nullif(p_row ->> 'frozen_at', '')::timestamptz,
-       coalesce(p_row -> 'rule_sources', '[]'::jsonb),
-       v_meta,
-       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
-       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_clinical_requirements SET
-      unit_id        = coalesce(v_unit, unit_id),
-      session_id     = coalesce(v_session, session_id),
-      booking_id     = coalesce(nullif(p_row ->> 'booking_id', '')::uuid, booking_id),
-      party_id       = coalesce(nullif(p_row ->> 'party_id', '')::uuid, party_id),
-      service_id     = coalesce(nullif(p_row ->> 'service_id', '')::uuid, service_id),
-      kind           = v_kind,
-      scope          = v_scope,
-      blocks_start   = coalesce((p_row ->> 'blocks_start')::boolean, blocks_start),
-      blocks_finish  = coalesce((p_row ->> 'blocks_finish')::boolean, blocks_finish),
-      status         = v_status,
-      subject_type   = v_subj_t,
-      -- \`coalesce\` e n\xE3o substitui\xE7\xE3o: a segunda onda resolve o que a primeira
-      -- n\xE3o alcan\xE7ou, e nunca apaga o que j\xE1 estava resolvido.
-      subject_id     = coalesce(v_subj_id, subject_id),
-      candidate_type = v_cand_t,
-      candidate_id   = coalesce(v_cand_id, candidate_id),
-      resolved_via   = nullif(p_row ->> 'resolved_via', ''),
-      resolved_at    = nullif(p_row ->> 'resolved_at', '')::timestamptz,
-      valid_until    = nullif(p_row ->> 'valid_until', '')::timestamptz,
-      frozen_at      = nullif(p_row ->> 'frozen_at', '')::timestamptz,
-      rule_sources   = coalesce(p_row -> 'rule_sources', rule_sources),
-      metadata       = migration._merge_meta(metadata, v_meta),
-      updated_at     = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
-    WHERE id = p_id;
-  END IF;
-
-  IF v_standalone THEN
-    PERFORM migration._audit(p_tenant, 'public.plg_clinical_requirements', p_id,
-      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
-  END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
-    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 6. A revis\xE3o do servi\xE7o, e os formul\xE1rios dela
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_service_revision(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_service    uuid;
-  v_number     integer;
-  v_existing   uuid;
-  v_created    boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a service revision needs an id');
-  END IF;
-
-  BEGIN v_service := (p_row ->> 'service_id')::uuid; EXCEPTION WHEN OTHERS THEN v_service := NULL; END;
-  IF v_service IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', 'a service revision needs the service it freezes');
-  END IF;
-  v_number := greatest(coalesce(nullif(p_row ->> 'revision_number', '')::integer, 1), 1);
-
-  SELECT tenant_id INTO v_existing FROM public.plg_clinical_service_revisions WHERE id = p_id;
-  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
-      'reason', format('service revision %s already exists in another tenant', p_id));
-  END IF;
-
-  IF v_existing IS NULL THEN
-    INSERT INTO public.plg_clinical_service_revisions
-      (id, tenant_id, service_id, revision_number, price, duration_minutes, deadline_days,
-       metadata, created_at, updated_at)
-    VALUES
-      (p_id, p_tenant, v_service, v_number,
-       nullif(p_row ->> 'price', '')::numeric,
-       nullif(p_row ->> 'duration_minutes', '')::integer,
-       nullif(p_row ->> 'deadline_days', '')::integer,
-       v_meta,
-       coalesce(nullif(p_row ->> 'created_at', '')::timestamptz, now()),
-       coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now()));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_clinical_service_revisions SET
-      service_id       = v_service,
-      revision_number  = v_number,
-      price            = nullif(p_row ->> 'price', '')::numeric,
-      duration_minutes = nullif(p_row ->> 'duration_minutes', '')::integer,
-      deadline_days    = nullif(p_row ->> 'deadline_days', '')::integer,
-      metadata         = migration._merge_meta(metadata, v_meta),
-      updated_at       = coalesce(nullif(p_row ->> 'updated_at', '')::timestamptz, now())
-    WHERE id = p_id;
-  END IF;
-
-  IF v_standalone THEN
-    PERFORM migration._audit(p_tenant, 'public.plg_clinical_service_revisions', p_id,
-      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
-  END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
-    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $function$;
-
--- O facet: acrescenta um formul\xE1rio ao jsonb da revis\xE3o. A chave de dedupe \xE9 o
--- id da linha do V1, e \xE9 isso que faz a onda rodar duas vezes sem duplicar.
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_revision_form(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_rev        uuid;
-  v_ref        text := p_row ->> 'v1_ref';
-  v_entry      jsonb;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-
-  BEGIN v_rev := (p_row ->> 'revision_id')::uuid; EXCEPTION WHEN OTHERS THEN v_rev := NULL; END;
-  IF v_rev IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', 'a revision form needs the revision it belongs to');
-  END IF;
-  IF NOT EXISTS (SELECT 1 FROM public.plg_clinical_service_revisions r
-                  WHERE r.id = v_rev AND r.tenant_id = p_tenant) THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', 'the revision this form belongs to has not arrived yet');
-  END IF;
-
-  v_entry := jsonb_build_object(
-    'v1_ref', v_ref,
-    'v1_form_template_ref', p_row ->> 'v1_form_template_ref');
-
-  UPDATE public.plg_clinical_service_revisions
-     SET form_template_refs = (
-           SELECT coalesce(jsonb_agg(e), '[]'::jsonb)
-             FROM (SELECT e FROM jsonb_array_elements(form_template_refs) e
-                    WHERE e ->> 'v1_ref' IS DISTINCT FROM v_ref
-                   UNION ALL SELECT v_entry) s(e)),
-         updated_at = now()
-   WHERE id = v_rev;
-
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', v_rev, 'reason', 'attached');
-END $function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 7. O writer do desfecho
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-CREATE OR REPLACE FUNCTION migration.upsert_clinical_prepaid_outcome(
-  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
-AS $function$
-DECLARE
-  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_outcome    text  := nullif(p_row ->> 'outcome', '');
-  v_booking    uuid;
-  v_unit       uuid;
-  v_existing   uuid;
-  v_created    boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'an outcome needs an id');
-  END IF;
-  IF v_outcome IS NULL OR v_outcome NOT IN ('contracted','declined','postponed') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('outcome %L is not one of the three the V1 writes', v_outcome));
-  END IF;
-
-  BEGIN v_booking := (p_row ->> 'booking_id')::uuid; EXCEPTION WHEN OTHERS THEN v_booking := NULL; END;
-  IF v_booking IS NOT NULL THEN
-    SELECT a.unit_id INTO v_unit FROM public.appointments a
-     WHERE a.id = v_booking AND a.tenant_id = p_tenant;
-  END IF;
-
-  SELECT tenant_id INTO v_existing FROM public.plg_clinical_prepaid_outcomes WHERE id = p_id;
-  IF v_existing IS NOT NULL AND v_existing <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant',
-      'reason', format('outcome %s already exists in another tenant', p_id));
-  END IF;
-
-  IF v_existing IS NULL THEN
-    INSERT INTO public.plg_clinical_prepaid_outcomes
-      (id, tenant_id, unit_id, booking_id, order_item_id, outcome, reason, decided_at, metadata, created_at, updated_at)
-    VALUES
-      (p_id, p_tenant, v_unit, v_booking,
-       nullif(p_row ->> 'order_item_id', '')::uuid,
-       v_outcome, p_row ->> 'reason',
-       coalesce(nullif(p_row ->> 'decided_at', '')::timestamptz, now()),
-       v_meta, now(), now());
-    v_created := true;
-  ELSE
-    UPDATE public.plg_clinical_prepaid_outcomes SET
-      unit_id       = coalesce(v_unit, unit_id),
-      booking_id    = coalesce(v_booking, booking_id),
-      order_item_id = coalesce(nullif(p_row ->> 'order_item_id', '')::uuid, order_item_id),
-      outcome       = v_outcome,
-      reason        = CASE WHEN p_row ? 'reason' THEN p_row ->> 'reason' ELSE reason END,
-      decided_at    = coalesce(nullif(p_row ->> 'decided_at', '')::timestamptz, decided_at),
-      metadata      = migration._merge_meta(metadata, v_meta),
-      updated_at    = now()
-    WHERE id = p_id;
-  END IF;
-
-  IF v_standalone THEN
-    PERFORM migration._audit(p_tenant, 'public.plg_clinical_prepaid_outcomes', p_id,
-      jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END));
-  END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
-    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $function$;
-
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
--- 8. As seis linhas do de-para
--- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-SET LOCAL migration.allowlist_unlock = 'on';
-
-SELECT migration._allow(
-  'service_revisions', 'public.plg_clinical_service_revisions', 'clinical', 'clinical_service_revision',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'uuid',             'id',
-    'service_id',       'service_id@services',
-    'revision_number',  'revision_number',
-    'price',            'price',
-    'duration_minutes', 'duration_minutes',
-    'deadline_days',    'deadline_days',
-    'created_at',       'created_at',
-    'tenant_id',        '-',
-    'id',               'jsonb:clinical.v1_ref'),
-  'A vers\xE3o congelada do servi\xE7o. Vem ANTES da sess\xE3o porque \xE9 ela que d\xE1 o '
-  'pre\xE7o e o prazo que valiam no dia da contrata\xE7\xE3o.'
-);
-
-SELECT migration._allow(
-  'service_revision_forms', 'public.plg_clinical_service_revisions', 'clinical', 'clinical_revision_form',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'service_revision_id', 'revision_id@service_revisions',
-    'form_template_id',    'v1_form_template_ref',
-    'id',                  'v1_ref',
-    'uuid',                '-',
-    'service_id',          '-',
-    'created_at',          '-',
-    'tenant_id',           '-'),
-  '87 linhas em 110 revis\xF5es. N\xE3o tem tabela pr\xF3pria: entra no jsonb '
-  '\`form_template_refs\` da revis\xE3o, e o writer \xE9 um facet que dedupe pelo id do '
-  'V1 \u2014 rodar a onda duas vezes n\xE3o duplica.'
-);
-
-SELECT migration._allow(
-  'journey_executions', 'public.plg_clinical_sessions', 'clinical', 'clinical_session',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'uuid',                           'id',
-    'journey_status',                 'status',
-    'appointment_id',                 'booking_id@appointments',
-    'appointment_service_id',         'booking_item_id@appointment_services',
-    'client_id',                      'party_id@clients',
-    'professional_id',                'assignee_id@professionals',
-    'execution_professional_id',      'performed_by_id@professionals',
-    'service_id',                     'service_id@services',
-    'invoice_item_id',                'order_item_id@invoice_items',
-    'quote_item_id',                  'quote_item_id@quote_items',
-    'opportunity_id',                 'deal_id@opportunities',
-    'parent_execution_id',            'parent_session_id@journey_executions',
-    'source_evaluation_execution_id', 'source_evaluation_id@journey_executions',
-    'unit_numeric_id',                'unit_id@companies',
-    'revision_number',                'revision_number',
-    'appointment_date',               'scheduled_for',
-    'execution_start_time',           'started_at',
-    'execution_end_time',             'ended_at',
-    'products_initialized',           'products_initialized',
-    'notes',                          'notes',
-    'created_at',                     'created_at',
-    'updated_at',                     'updated_at',
-    'tenant_id',                      '-',
-    'product_id',                     '-',
-    'status',                         'jsonb:clinical.v1_status',
-    'execution_photos',               'jsonb:clinical.v1_execution_photos',
-    'id',                             'jsonb:clinical.v1_ref'),
-  'A sess\xE3o de execu\xE7\xE3o. \`journey_status\` \xE9 quem manda no estado \u2014 tem sete '
-  'palavras contra as quatro de \`status\`, e \xE9 a \xFAnica que separa or\xE7ado de '
-  'contratado; a outra fica em metadata. \`product_id\` sai: 0 de 233.950 '
-  'preenchidas. As fotos ficam em metadata at\xE9 virarem linhas de '
-  'public.documents, que \xE9 onde arquivo mora.'
-);
-
-SELECT migration._allow(
-  'execution_products', 'public.plg_clinical_session_products', 'clinical', 'clinical_session_product',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'uuid',                   'id',
-    'journey_execution_id',   'session_id@journey_executions',
-    'product_id',             'product_id@products',
-    'invoice_item_id',        'order_item_id@invoice_items',
-    'professional_id',        'assignee_id@professionals',
-    'used_unit_id',           'used_unit_id@measurement_units',
-    'unit_id',                '-',
-    'default_quantity',       'default_quantity',
-    'used_quantity',          'used_quantity',
-    'execution_date',         'executed_on',
-    'is_audited',             'is_audited',
-    'audited_at',             'audited_at',
-    'audit_notes',            'audit_notes',
-    'audited_by_user_id',     '-',
-    'created_at',             'created_at',
-    'updated_at',             'updated_at',
-    'tenant_id',              '-',
-    'stock_deducted',         '-',
-    'stock_movement_id',      '-',
-    'stock_position_id',      '-',
-    'position_allocations',   '-',
-    'unit_label_allocations', '-',
-    'consumption_photos',     'jsonb:clinical.v1_consumption_photos',
-    'id',                     'jsonb:clinical.v1_ref'),
-  'O produto consumido. As cinco colunas de baixa de estoque saem porque est\xE3o '
-  'VAZIAS: 0 de 117.015 no tenant 1. O consumo do V1 nunca chegou ao raz\xE3o \u2014 \xE9 '
-  'o que o Guia descreve na jornada auditoria-de-uso-e-estoque. A unidade vem '
-  'da sess\xE3o, no writer, e n\xE3o da coluna \`unit_id\` da origem.'
-);
-
-SELECT migration._allow(
-  'execution_requirements', 'public.plg_clinical_requirements', 'clinical', 'clinical_requirement',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'journey_execution_id', 'session_id@journey_executions',
-    'appointment_id',       'booking_id@appointments',
-    'client_id',            'party_id@clients',
-    'service_id',           'service_id@services',
-    'kind',                 'kind',
-    'scope',                'scope',
-    'status',               'status',
-    'blocks_start',         'blocks_start',
-    'blocks_finish',        'blocks_finish',
-    'resolved_table',       'subject_type',
-    'resolved_id',          'v1_resolved_ref',
-    'candidate_table',      'candidate_type',
-    'candidate_id',         'v1_candidate_ref',
-    'resolved_via',         'resolved_via',
-    'resolved_at',          'resolved_at',
-    'valid_until',          'valid_until',
-    'frozen_at',            'frozen_at',
-    'rule_sources',         'rule_sources',
-    'created_at',           'created_at',
-    'updated_at',           'updated_at',
-    'tenant_id',            '-',
-    'ref_id',               'jsonb:clinical.v1_ref_id',
-    'id',                   'jsonb:clinical.v1_ref'),
-  'O que trava come\xE7ar e terminar. Sem \`uuid\` na origem \u2014 o id do destino nasce '
-  'determin\xEDstico da chave num\xE9rica. \`resolved_table\`/\`resolved_id\` \xE9 refer\xEAncia '
-  'polim\xF3rfica e o \`@tabela\` do de-para \xE9 est\xE1tico, ent\xE3o quem resolve \xE9 o '
-  'writer, lendo o ledger com o nome que chegou na linha.'
-);
-
-SELECT migration._allow(
-  'prepaid_item_outcomes', 'public.plg_clinical_prepaid_outcomes', 'clinical', 'clinical_prepaid_outcome',
-  '{}'::jsonb, NULL::text[],
-  jsonb_build_object(
-    'appointment_id',   'booking_id@appointments',
-    'invoice_item_id',  'order_item_id@invoice_items',
-    'outcome',          'outcome',
-    'reason',           'reason',
-    'decided_at',       'decided_at',
-    'decided_by',       '-',
-    'tenant_id',        '-',
-    'id',               'jsonb:clinical.v1_ref'),
-  'O desfecho do servi\xE7o contratado e n\xE3o executado no dia. \`decided_by\` \xE9 '
-  'usu\xE1rio do auth do V1, que n\xE3o atravessa \u2014 fica de fora em vez de virar uma '
-  'FK que aponta para nada.'
-);
-
-RESET migration.allowlist_unlock;
-
-REVOKE ALL ON FUNCTION migration._clinical_resolve(uuid, text, text) FROM PUBLIC, anon, authenticated;
-GRANT EXECUTE ON FUNCTION migration._clinical_resolve(uuid, text, text) TO service_role;
-DO $$
-DECLARE f text;
-BEGIN
-  FOREACH f IN ARRAY ARRAY['upsert_clinical_session', 'upsert_clinical_session_product',
-                           'upsert_clinical_requirement', 'upsert_clinical_service_revision',
-                           'upsert_clinical_revision_form', 'upsert_clinical_prepaid_outcome'] LOOP
-    EXECUTE format('REVOKE ALL ON FUNCTION migration.%I(uuid, uuid, jsonb, jsonb) FROM PUBLIC, anon, authenticated', f);
-    EXECUTE format('GRANT EXECUTE ON FUNCTION migration.%I(uuid, uuid, jsonb, jsonb) TO service_role', f);
-  END LOOP;
-END $$;
-`;
-var MIGRATION_003_A_PERMISSAO_SE_PERGUNTA_POR_UNIDADE_NAO_POR_LINHA = `-- A permiss\xE3o se pergunta por unidade, n\xE3o por linha.
---
--- A tela \`Estoque \u2192 Auditoria de uso\` estourava o \`statement_timeout\`. Medido
--- no cluster, como \`authenticated\`, tenant Espa\xE7o Facial:
---
---     select * from v_inventory_usage_audit order by used_at desc limit 50
---       \u2192 97.143 ms
---
--- A vista n\xE3o era a culpada. As duas tabelas que ela l\xEA j\xE1 eram lentas sozinhas:
---
---     select count(*) from plg_clinical_session_products   19.000 ms
---     select count(*) from plg_clinical_sessions           22.500 ms
---
--- \u2500\u2500 A linha que custava \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- A pol\xEDtica que a 001 escreveu chama \`app.has_permission('clinical.read',
--- unit_id)\` \u2014 e \`unit_id\` \xE9 COLUNA, ent\xE3o a chamada \xE9 por LINHA. S\xE3o 116.911
--- produtos consumidos e 233.556 sess\xF5es; o Espa\xE7o Facial tem 67 unidades.
---
--- \xC9 a mesma forma do defeito que o spine 121 corrigiu em \`people\`, e a mesma
--- corre\xE7\xE3o: a pergunta n\xE3o muda dentro da unidade, ent\xE3o ela se faz uma vez
--- POR UNIDADE. \`unit_id IN (subconsulta n\xE3o correlacionada)\` \xE9 resolvido pelo
--- planejador como hash montado uma vez; a subconsulta percorre \`app.units\` do
--- inquilino e aplica ali os dois predicados que antes rodavam por linha.
---
--- A reescrita \xE9 EQUIVALENTE por constru\xE7\xE3o, n\xE3o por argumento: s\xE3o os mesmos
--- dois predicados (\`app.has_unit\` e \`app.has_permission\`) sobre os mesmos
--- valores de \`unit_id\`, s\xF3 que avaliados uma vez por valor distinto em vez de
--- uma vez por linha. A linha sem unidade continua decidida pela permiss\xE3o de
--- inquilino, como antes.
---
--- Medido depois, com ROLLBACK, antes de escrever este arquivo:
---
---     plg_clinical_session_products   116.911 linhas     450 ms   (era 19.000)
---     plg_clinical_sessions           233.556 linhas   1.070 ms   (era 22.500)
---     auditoria de uso, 50 linhas          50 linhas   1.330 ms   (era 97.143)
---
--- As contagens s\xE3o ID\xCANTICAS \xE0s de antes \u2014 \xE9 o teste que importa numa mudan\xE7a
--- de pol\xEDtica, porque uma que fica r\xE1pida devolvendo menos linhas n\xE3o ficou
--- r\xE1pida, ficou errada.
---
--- Idempotente.
-
-DO $$
-DECLARE
-  t text;
-  v_unidade text := $q$unit_id IN (SELECT u.id FROM app.units u
-                     WHERE u.tenant_id = (SELECT app.current_tenant_id())
-                       AND app.has_unit(u.id)
-                       AND app.has_permission('clinical.read', u.id))$q$;
-BEGIN
-  FOREACH t IN ARRAY ARRAY['plg_clinical_sessions', 'plg_clinical_session_products',
-                           'plg_clinical_requirements', 'plg_clinical_prepaid_outcomes'] LOOP
-    IF to_regclass('public.' || t) IS NULL THEN CONTINUE; END IF;
-    EXECUTE format($f$ALTER POLICY %I ON public.%I USING (
-        tenant_id = (SELECT app.current_tenant_id())
-        AND (CASE WHEN unit_id IS NULL
-                  THEN (SELECT app.has_permission('clinical.read', NULL::uuid))
-                  ELSE %s END))$f$, t || '_authz_select', t, v_unidade);
-  END LOOP;
-END $$;
-
--- \`plg_clinical_service_revisions\` fica como est\xE1: ela n\xE3o tem unidade \u2014 a
--- revis\xE3o \xE9 do CAT\xC1LOGO, e o pre\xE7o congelado de um servi\xE7o vale na rede
--- inteira. A pol\xEDtica dela j\xE1 decide uma vez por consulta.
-
--- A auditoria de uso ordena por data e corta em 50. Sem \xEDndice, isso \xE9 ordenar
--- 116.911 linhas para jogar 116.861 fora.
-CREATE INDEX IF NOT EXISTS plg_clinical_session_products_executed_idx
-  ON public.plg_clinical_session_products USING btree (tenant_id, executed_on DESC);
-`;
-var MIGRATION_004_A_REGUA_VOLTA_A_SER_APURADA = `-- ============================================================================
--- A r\xE9gua do atendimento volta a ser APURADA
---
--- SINTOMA: 6.236 linhas de exig\xEAncia atravessaram do V1 e est\xE3o congeladas.
--- Nada no V2 as recalcula: um atendimento novo nasce sem r\xE9gua, e um antigo
--- nunca responde de novo "o que este servi\xE7o exigia". A r\xE9gua migrada \xE9 foto,
--- n\xE3o motor.
---
--- O V1 resolve isso em duas fun\xE7\xF5es (\`materialize_execution_requirements\` e
--- \`refresh_execution_requirements\`, migration 20260927130000). Esta migration \xE9
--- o espelho delas sobre o modelo do V2, com tr\xEAs diferen\xE7as declaradas:
---
---   1. CONTRATO E TERMO DE SESS\xC3O FICAM DE FORA. Os blocos d, e, f do V1
---      dependem de \`contract_templates\` e \`generated_contracts\`, que o V2 n\xE3o
---      modela. Emitir uma bola de contrato que nada pode resolver deixaria todo
---      atendimento eternamente pendente \u2014 indicador errado \xE9 pior que nenhum.
---   2. O QUE A EXIG\xCANCIA PEDE ganha colunas. O V1 tem \`ref_id\` (o modelo de
---      formul\xE1rio exigido); o ETL despejou isso em \`metadata.clinical.v1_ref_id\`
---      e a tabela ficou sem discriminador \u2014 por isso h\xE1 1.378 grupos
---      (session, kind) repetidos, que s\xE3o formul\xE1rios diferentes indistingu\xEDveis.
---      \`ref_type\`/\`ref_id\` devolvem a pergunta; a chave \xFAnica cobre s\xF3 as linhas
---      que este motor escreve, porque as migradas n\xE3o t\xEAm como ser desempatadas
---      enquanto os modelos de formul\xE1rio n\xE3o chegarem.
---   3. DUAS BANDEIRAS DE SERVI\xC7O n\xE3o vieram do V1 (\`requires_evaluation\` e
---      \`always_ask_used_products\`). Sem elas os blocos g e i ficariam mudos,
---      ent\xE3o entram em \`products\` \u2014 onde o servi\xE7o mora no V2.
---
--- Modo: \`off\` (nada acontece) \xB7 \`shadow\` (grava e n\xE3o muda tela) \xB7 \`on\`.
--- L\xEA-se de \`tenants.settings -> 'execution_requirements' ->> 'mode'\`.
--- ============================================================================
-
--- \u2500\u2500\u2500 0. O que faltava para a pergunta caber \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-ALTER TABLE public.products
-  ADD COLUMN IF NOT EXISTS requires_evaluation boolean NOT NULL DEFAULT false,
-  ADD COLUMN IF NOT EXISTS always_ask_used_products boolean NOT NULL DEFAULT false;
-
-COMMENT ON COLUMN public.products.requires_evaluation IS
-  'Servi\xE7o que s\xF3 se executa depois de uma avalia\xE7\xE3o vinculada (bloco g da r\xE9gua).';
-COMMENT ON COLUMN public.products.always_ask_used_products IS
-  'Servi\xE7o que sempre pergunta os produtos usados, mesmo sem ficha t\xE9cnica (bloco i).';
-
-ALTER TABLE public.plg_clinical_requirements
-  ADD COLUMN IF NOT EXISTS ref_type text,
-  ADD COLUMN IF NOT EXISTS ref_id uuid;
-
-COMMENT ON COLUMN public.plg_clinical_requirements.ref_type IS
-  'O que a exig\xEAncia PEDE (form_template). N\xE3o confundir com subject_*, que \xE9 o que a RESOLVEU.';
-
--- Chave \xFAnica s\xF3 das linhas deste motor: as migradas perderam o discriminador
--- (ver cabe\xE7alho) e colidiriam entre si.
-CREATE UNIQUE INDEX IF NOT EXISTS plg_clinical_requirements_engine_key
-  ON public.plg_clinical_requirements (session_id, kind, (coalesce(ref_id, '00000000-0000-0000-0000-000000000000'::uuid)))
-  WHERE metadata -> 'migration' IS NULL;
-
-CREATE INDEX IF NOT EXISTS plg_clinical_requirements_booking_status
-  ON public.plg_clinical_requirements (booking_id, status);
-
--- \u2500\u2500\u2500 1. O modo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE OR REPLACE FUNCTION public.clinical_requirements_mode(p_tenant uuid)
-RETURNS text LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public'
-AS $fn$
-  SELECT CASE lower(coalesce(t.settings -> 'execution_requirements' ->> 'mode', 'off'))
-           WHEN 'shadow' THEN 'shadow'
-           WHEN 'on' THEN 'on'
-           ELSE 'off'
-         END
-  FROM public.tenants t WHERE t.id = p_tenant;
-$fn$;
-
--- \u2500\u2500\u2500 2. Uma linha, idempotente (o OR dos bloqueios \xE9 do V1) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE OR REPLACE FUNCTION public.clinical_requirement_upsert(
-  p_tenant uuid, p_unit uuid, p_booking uuid, p_session uuid, p_party uuid, p_service uuid,
-  p_kind text, p_scope text, p_ref_type text, p_ref_id uuid, p_rule text,
-  p_blocks_start boolean, p_blocks_finish boolean)
-RETURNS integer LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
-AS $fn$
-DECLARE v_id uuid;
-BEGIN
-  SELECT r.id INTO v_id FROM public.plg_clinical_requirements r
-   WHERE r.session_id = p_session AND r.kind = p_kind
-     AND coalesce(r.ref_id, '00000000-0000-0000-0000-000000000000'::uuid)
-       = coalesce(p_ref_id, '00000000-0000-0000-0000-000000000000'::uuid)
-     AND r.metadata -> 'migration' IS NULL;
-
-  IF v_id IS NULL THEN
-    INSERT INTO public.plg_clinical_requirements (
-      tenant_id, unit_id, booking_id, session_id, party_id, service_id,
-      kind, scope, ref_type, ref_id, rule_sources, blocks_start, blocks_finish, status)
-    VALUES (p_tenant, p_unit, p_booking, p_session, p_party, p_service,
-      p_kind, p_scope, p_ref_type, p_ref_id, jsonb_build_array(p_rule),
-      coalesce(p_blocks_start, false), coalesce(p_blocks_finish, false), 'pending');
-    RETURN 1;
-  END IF;
-
-  -- J\xE1 existe: soma a origem da regra e faz o OR dos bloqueios. Uma linha
-  -- resolvida ou congelada n\xE3o volta a pendente por aqui.
-  UPDATE public.plg_clinical_requirements r
-     SET rule_sources = CASE WHEN r.rule_sources @> to_jsonb(p_rule) THEN r.rule_sources
-                             ELSE r.rule_sources || to_jsonb(p_rule) END,
-         blocks_start = r.blocks_start OR coalesce(p_blocks_start, false),
-         blocks_finish = r.blocks_finish OR coalesce(p_blocks_finish, false),
-         status = CASE WHEN r.status = 'not_applicable' THEN 'pending' ELSE r.status END,
-         updated_at = now()
-   WHERE r.id = v_id AND r.frozen_at IS NULL;
-  RETURN 0;
-END $fn$;
-
--- \u2500\u2500\u2500 3. Materializar as linhas em branco de UMA sess\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE OR REPLACE FUNCTION public.clinical_requirements_materialize(p_session uuid)
-RETURNS integer LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
-AS $fn$
-DECLARE
-  s record; sv record; r record; cfg jsonb;
-  v_mode text; v_n int := 0; v_booking_status text; v_rule text;
-  v_is_revision boolean; v_has_parent boolean; v_rev_num int; v_kind text;
-BEGIN
-  SELECT * INTO s FROM public.plg_clinical_sessions WHERE id = p_session;
-  IF NOT FOUND OR s.booking_id IS NULL THEN RETURN 0; END IF;
-
-  v_mode := public.clinical_requirements_mode(s.tenant_id);
-  IF v_mode = 'off' THEN RETURN 0; END IF;
-
-  SELECT a.status INTO v_booking_status FROM public.appointments a WHERE a.id = s.booking_id;
-  -- Hist\xF3rico n\xE3o ganha linha: sess\xE3o j\xE1 executada em atendimento que n\xE3o est\xE1
-  -- em curso \xE9 fato consumado (mesma regra do V1).
-  IF s.status IN ('executed', 'invoiced') AND coalesce(v_booking_status, '') <> 'in_progress' THEN
-    RETURN 0;
-  END IF;
-
-  BEGIN
-    SELECT p.service_kind, p.requires_evaluation, p.always_ask_used_products, p.category_id
-      INTO sv FROM public.products p WHERE p.id = s.service_id;
-    IF NOT FOUND THEN RETURN 0; END IF;
-    v_kind := coalesce(sv.service_kind, 'standard');
-
-    -- QUEM \xC9 REVIS\xC3O. O V1 tem um booleano (\`is_revision\`) ao lado do n\xFAmero.
-    -- No V2 sobrou s\xF3 o n\xFAmero \u2014 e o ETL gravou \`revision_number = 1\` em TODA
-    -- sess\xE3o, ent\xE3o o n\xFAmero n\xE3o distingue nada: lido como "\xE9 revis\xE3o", ele
-    -- transformou 54 de 54 sess\xF5es em revis\xE3o, tirou o item de fatura de 21
-    -- delas e inventou v\xEDnculo de revis\xE3o em 43. O que de fato separa as duas
-    -- coisas no V2 \xE9 o PAI: revis\xE3o aponta para a sess\xE3o original. Conferido
-    -- contra as 288 exig\xEAncias migradas destes mesmos atendimentos: o V1
-    -- gravou \`invoice_item\` exatamente nas 21 sess\xF5es \`standard\` sem pai, e
-    -- \`revision_link\` exatamente nas 8 de \`return\` mais as 3 \`standard\` com pai.
-    v_rev_num := coalesce(s.revision_number, 0);
-    v_has_parent := s.parent_session_id IS NOT NULL;
-    v_is_revision := v_has_parent OR v_kind = 'return';
-
-    cfg := coalesce((SELECT t.settings -> 'evaluation_flow' FROM public.tenants t WHERE t.id = s.tenant_id), '{}'::jsonb);
-    IF jsonb_typeof(cfg) <> 'object' THEN cfg := '{}'::jsonb; END IF;
-
-    -- a) Formul\xE1rios universais do tenant \u2014 escopo atendimento.
-    FOR r IN SELECT ft.id FROM public.plg_forms_templates ft
-              WHERE ft.tenant_id = s.tenant_id AND ft.is_active AND coalesce(ft.is_deleted, false) = false
-                AND coalesce(ft.required_on_attendance, false)
-    LOOP
-      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-               s.party_id, s.service_id, 'form', 'attendance', 'form_template', r.id,
-               'forms_templates.required_on_attendance', false, false);
-    END LOOP;
-
-    IF NOT v_has_parent THEN
-      -- b) Formul\xE1rios do servi\xE7o.
-      FOR r IN SELECT sd.template_id, coalesce(sd.requirement_scope, 'attendance') AS scope
-                 FROM public.plg_forms_service_defaults sd
-                 JOIN public.plg_forms_templates ft ON ft.id = sd.template_id AND ft.is_active
-                WHERE sd.product_id = s.service_id AND sd.tenant_id = s.tenant_id
-      LOOP
-        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-                 s.party_id, s.service_id, 'form',
-                 CASE WHEN r.scope = 'service' THEN 'service' ELSE 'attendance' END,
-                 'form_template', r.template_id, 'forms_service_defaults', false, false);
-      END LOOP;
-    ELSE
-      -- c) Formul\xE1rios da revis\xE3o, pelo n\xFAmero dela. No V2 os modelos da revis\xE3o
-      --    moram numa lista dentro da pr\xF3pria revis\xE3o.
-      FOR r IN SELECT (e.value #>> '{}')::uuid AS template_id
-                 FROM public.plg_clinical_service_revisions rev,
-                      LATERAL jsonb_array_elements(coalesce(rev.form_template_refs, '[]'::jsonb)) e
-                WHERE rev.tenant_id = s.tenant_id AND rev.service_id = s.service_id
-                  AND rev.revision_number = v_rev_num
-                  AND (e.value #>> '{}') ~ '^[0-9a-f-]{36}$'
-      LOOP
-        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-                 s.party_id, s.service_id, 'form', 'service', 'form_template', r.template_id,
-                 'clinical_service_revisions.form_template_refs', false, false);
-      END LOOP;
-    END IF;
-
-    -- d, e, f) CONTRATO e TERMO DE SESS\xC3O: fora, por falta de modelo no V2.
-    --          Ver o cabe\xE7alho desta migration.
-
-    -- g) Avalia\xE7\xE3o vinculada.
-    IF v_kind = 'standard' THEN
-      IF coalesce(sv.requires_evaluation, false) THEN
-        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-                 s.party_id, s.service_id, 'evaluation', 'service', NULL, NULL,
-                 'products.requires_evaluation', false, false);
-      ELSIF coalesce((cfg ->> 'require_evaluation_for_kind_service')::boolean, false) THEN
-        v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-                 s.party_id, s.service_id, 'evaluation', 'service', NULL, NULL,
-                 'evaluation_flow.require_evaluation_for_kind_service', false, false);
-      END IF;
-    END IF;
-
-    -- h) Revis\xE3o vinculada ao servi\xE7o original: trava come\xE7ar E terminar.
-    IF v_is_revision AND coalesce((cfg ->> 'revision_link_required')::boolean, false) THEN
-      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-               s.party_id, s.service_id, 'revision_link', 'service', NULL, NULL,
-               'evaluation_flow.revision_link_required', true, true);
-    END IF;
-
-    -- i) Produtos utilizados: ficha t\xE9cnica, "sempre perguntar", ou j\xE1 lan\xE7ado.
-    v_rule := NULL;
-    IF EXISTS (SELECT 1 FROM public.plg_inventory_recipes rc
-                WHERE rc.product_id = s.service_id AND rc.tenant_id = s.tenant_id
-                  AND coalesce(rc.is_active, true)) THEN
-      v_rule := 'inventory_recipes';
-    ELSIF coalesce(sv.always_ask_used_products, false) THEN
-      v_rule := 'products.always_ask_used_products';
-    ELSIF EXISTS (SELECT 1 FROM public.plg_clinical_session_products sp
-                   WHERE sp.session_id = s.id
-                      OR (s.order_item_id IS NOT NULL AND sp.order_item_id = s.order_item_id)) THEN
-      v_rule := 'clinical_session_products';
-    END IF;
-    IF v_rule IS NOT NULL THEN
-      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-               s.party_id, s.service_id, 'products', 'service', NULL, NULL, v_rule, false, false);
-    END IF;
-
-    -- j) Item de fatura: servi\xE7o comum, n\xE3o-revis\xE3o.
-    IF v_kind = 'standard' AND NOT v_has_parent THEN
-      v_n := v_n + public.clinical_requirement_upsert(s.tenant_id, s.unit_id, s.booking_id, s.id,
-               s.party_id, s.service_id, 'invoice_item', 'service', NULL, NULL, 'billing', false, false);
-    END IF;
-  EXCEPTION WHEN others THEN
-    -- Nunca derruba quem chama: a fonte (a sess\xE3o) n\xE3o pode falhar por causa da r\xE9gua.
-    RAISE WARNING 'clinical_requirements_materialize(%): %', p_session, sqlerrm;
-    RETURN 0;
-  END;
-  RETURN v_n;
-END $fn$;
-
--- \u2500\u2500\u2500 4. Reapurar as linhas de UM atendimento \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE OR REPLACE FUNCTION public.clinical_requirements_refresh(p_booking uuid, p_final boolean DEFAULT false)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public'
-AS $fn$
-DECLARE
-  a record; v_mode text; v_now timestamptz := now(); v_eval jsonb;
-  n_mat int := 0; n_reopen int := 0;
-  -- \`v_sessao\`, n\xE3o \`r\`: plpgsql resolve o nome da VARI\xC1VEL antes do apelido da
-  -- tabela, ent\xE3o um \`record r\` declarado aqui sequestra todo \`r.coluna\` dos
-  -- UPDATEs abaixo \u2014 e o erro que sai \xE9 "record r has no field booking_id".
-  v_sessao record;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.party_id, ap.status INTO a
-    FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_mode := public.clinical_requirements_mode(a.tenant_id);
-  IF v_mode = 'off' THEN RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'skipped', true); END IF;
-
-  p_final := coalesce(p_final, false) AND a.status = 'completed';
-
-  BEGIN
-    PERFORM pg_advisory_xact_lock(hashtextextended('clinical_req:' || p_booking::text, 0));
-    IF a.status = 'completed' AND NOT p_final THEN
-      RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'frozen', true);
-    END IF;
-
-    -- 1) Materializa o que falta (sess\xE3o nova, ficha t\xE9cnica criada depois).
-    FOR v_sessao IN SELECT cs.id FROM public.plg_clinical_sessions cs WHERE cs.booking_id = p_booking
-    LOOP
-      n_mat := n_mat + public.clinical_requirements_materialize(v_sessao.id);
-    END LOOP;
-
-    v_eval := coalesce((SELECT t.settings -> 'evaluation_flow' FROM public.tenants t WHERE t.id = a.tenant_id), '{}'::jsonb);
-    IF jsonb_typeof(v_eval) <> 'object' THEN v_eval := '{}'::jsonb; END IF;
-
-    -- 1b) Regra que saiu da configura\xE7\xE3o para de bloquear (o upsert reabre se voltar).
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'not_applicable', candidate_type = NULL, candidate_id = NULL, updated_at = v_now
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.frozen_at IS NULL
-       AND r.metadata -> 'migration' IS NULL
-       AND ((r.kind = 'revision_link' AND NOT coalesce((v_eval ->> 'revision_link_required')::boolean, false))
-         OR (r.kind = 'evaluation'
-             AND r.rule_sources = '["evaluation_flow.require_evaluation_for_kind_service"]'::jsonb
-             AND NOT coalesce((v_eval ->> 'require_evaluation_for_kind_service')::boolean, false)));
-
-    -- 2) Reabre o que perdeu a fonte. Linha congelada n\xE3o se mexe.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'pending', subject_type = NULL, subject_id = NULL, resolved_via = NULL,
-           resolved_at = NULL, valid_until = NULL, updated_at = v_now
-     WHERE r.booking_id = p_booking AND r.status = 'resolved' AND r.frozen_at IS NULL
-       AND ((r.subject_type = 'documents' AND NOT EXISTS (SELECT 1 FROM public.documents d WHERE d.id = r.subject_id))
-         OR (r.subject_type = 'clinical_sessions' AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions x WHERE x.id = r.subject_id))
-         OR (r.subject_type = 'items' AND NOT EXISTS (SELECT 1 FROM public.items oi WHERE oi.id = r.subject_id)));
-    GET DIAGNOSTICS n_reopen = ROW_COUNT;
-
-    -- 3) Formul\xE1rio universal: a \xFAltima resposta do cliente, em qualquer
-    --    atendimento, ainda dentro da validade do modelo.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
-           resolved_via = CASE WHEN x.subject_id = p_booking THEN 'attendance' ELSE 'auto_client' END,
-           resolved_at = v_now,
-           valid_until = CASE WHEN x.validity_days IS NULL THEN NULL
-                              ELSE x.eff + make_interval(days => x.validity_days) END,
-           updated_at = v_now
-      FROM (SELECT DISTINCT ON (fd.template_id) d.id, fd.template_id, d.subject_id,
-                   coalesce(d.updated_at, d.created_at) AS eff, ft.validity_days
-              FROM public.plg_forms_documents fd
-              JOIN public.documents d ON d.id = fd.document_id
-              JOIN public.plg_forms_templates ft ON ft.id = fd.template_id
-             WHERE d.person_id = a.party_id AND d.tenant_id = a.tenant_id
-             ORDER BY fd.template_id, coalesce(d.updated_at, d.created_at) DESC) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
-       AND r.scope = 'attendance' AND r.ref_id = x.template_id
-       AND r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb
-       AND (x.validity_days IS NULL OR x.eff + make_interval(days => x.validity_days) > v_now);
-
-    -- 4) Demais formul\xE1rios: qualquer resposta DESTE atendimento com o modelo.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM (SELECT DISTINCT ON (fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid))
-                   d.id, fd.template_id, fd.product_id
-              FROM public.plg_forms_documents fd
-              JOIN public.documents d ON d.id = fd.document_id
-             WHERE d.subject_type = 'appointment' AND d.subject_id = p_booking
-             ORDER BY fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid),
-                      coalesce(d.updated_at, d.created_at) DESC) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
-       AND r.ref_id = x.template_id
-       AND NOT (r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb)
-       AND (x.product_id IS NULL OR r.scope = 'attendance' OR x.product_id = r.service_id);
-
-    -- 5) Avalia\xE7\xE3o vinculada: a sess\xE3o aponta a avalia\xE7\xE3o que a autorizou.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = x.eval_id,
-           resolved_via = CASE WHEN x.same_booking THEN 'attendance' ELSE 'auto_client' END,
-           resolved_at = v_now, updated_at = v_now
-      FROM (SELECT r2.id AS req_id, e.id AS eval_id, (e.booking_id = p_booking) AS same_booking
-              FROM public.plg_clinical_requirements r2
-              JOIN public.plg_clinical_sessions cs ON cs.id = r2.session_id
-              JOIN public.plg_clinical_sessions e ON e.id = cs.source_evaluation_id
-             WHERE r2.booking_id = p_booking AND r2.kind = 'evaluation' AND r2.frozen_at IS NULL
-               AND (r2.status = 'pending' OR (r2.status = 'resolved' AND r2.resolved_via = 'legacy_grace'))) x
-     WHERE r.id = x.req_id;
-
-    -- 5b) Gra\xE7a legada: o cliente j\xE1 tem atendimento conclu\xEDdo com servi\xE7o de
-    --     avalia\xE7\xE3o. \xC9 a mesma concess\xE3o do V1, e vai marcada como tal.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'appointments', subject_id = x.booking_id,
-           resolved_via = 'legacy_grace', resolved_at = v_now, updated_at = v_now
-      FROM (SELECT ap.id AS booking_id
-              FROM public.appointments ap
-              JOIN public.appointment_items ai ON ai.booking_id = ap.id
-              JOIN public.products p ON p.id = ai.service_id AND p.service_kind = 'evaluation'
-             WHERE ap.party_id = a.party_id AND ap.tenant_id = a.tenant_id AND ap.status = 'completed'
-             ORDER BY ap.starts_at DESC NULLS LAST LIMIT 1) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'evaluation';
-
-    -- 6) Revis\xE3o vinculada ao servi\xE7o original.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.parent_session_id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'revision_link'
-       AND cs.parent_session_id IS NOT NULL
-       AND EXISTS (SELECT 1 FROM public.plg_clinical_sessions p WHERE p.id = cs.parent_session_id);
-
-    -- 7) Produtos: a sess\xE3o declara que foram conferidos.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'products'
-       AND coalesce(cs.products_initialized, false);
-
-    -- 8) Item de pedido vinculado. A linha do pedido no V2 \xE9 \`public.items\` \u2014
-    --    n\xE3o existe \`order_items\`; o pedido \xE9 o documento e o item \xE9 dele.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'items', subject_id = oi.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-      JOIN public.items oi ON oi.id = cs.order_item_id
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'invoice_item';
-
-    -- 9) Congelamento: s\xF3 na \xFAltima passada, com o atendimento conclu\xEDdo.
-    IF p_final THEN
-      UPDATE public.plg_clinical_requirements
-         SET frozen_at = coalesce(frozen_at, v_now), updated_at = v_now
-       WHERE booking_id = p_booking;
-    END IF;
-
-    RETURN jsonb_build_object(
-      'ok', true, 'mode', v_mode, 'materialized', n_mat, 'reopened', n_reopen,
-      'pending', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'pending'),
-      'resolved', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'resolved'),
-      'frozen', p_final);
-  EXCEPTION WHEN others THEN
-    RAISE WARNING 'clinical_requirements_refresh(%): %', p_booking, sqlerrm;
-    RETURN jsonb_build_object('ok', false, 'error', sqlerrm);
-  END;
-END $fn$;
-
--- \u2500\u2500\u2500 5. Quem pode chamar \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Escrita s\xF3 pelas fun\xE7\xF5es (definer). O app chama o refresh; o resto \xE9 interno.
-
-REVOKE ALL ON FUNCTION public.clinical_requirement_upsert(uuid, uuid, uuid, uuid, uuid, uuid, text, text, text, uuid, text, boolean, boolean) FROM public, anon, authenticated;
-REVOKE ALL ON FUNCTION public.clinical_requirements_materialize(uuid) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.clinical_requirements_mode(uuid) TO authenticated;
-GRANT EXECUTE ON FUNCTION public.clinical_requirements_refresh(uuid, boolean) TO authenticated;
-`;
-var MIGRATION_005_COMECAR_O_ATENDIMENTO_E_UM_GESTO_SO = `-- ============================================================================
--- Come\xE7ar o atendimento \xE9 UM gesto \u2014 e uma transa\xE7\xE3o s\xF3
---
--- No V1, "Iniciar Atendimento" grava tr\xEAs coisas no mesmo instante: o
--- agendamento vira \`in_progress\`, a execu\xE7\xE3o de cada servi\xE7o nasce, e a r\xE9gua \xE9
--- materializada (\`rpc/refresh_execution_requirements\`). Se qualquer uma falhar
--- sozinha o atendimento fica meio aberto: status trocado sem r\xE9gua, ou r\xE9gua
--- sem sess\xE3o \u2014 e a tela mostra uma bola que n\xE3o pertence a nada.
---
--- Por isso \xE9 uma fun\xE7\xE3o e n\xE3o tr\xEAs chamadas do app. A recep\xE7\xE3o e o profissional
--- podem apertar o bot\xE3o ao mesmo tempo, e o segundo n\xE3o pode duplicar sess\xE3o.
---
--- QUEM PODE: o V1 s\xF3 monta a r\xE9gua para quem est\xE1 VINCULADO A UM PROFISSIONAL,
--- e s\xF3 enxerga o atendimento DELE com aquele cliente. Aqui a regra \xE9 a mesma \u2014
--- e a recusa \xE9 FALADA (\`reason\`), n\xE3o silenciosa: a tela precisa dizer por que
--- o bot\xE3o n\xE3o serve, em vez de sumir com ele.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_created int := 0; v_item record; v_refresh jsonb;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.starts_at
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
-  END IF;
-
-  -- A pessoa por tr\xE1s do login. Nulo = login sem ficha (o dono que criou o
-  -- espa\xE7o, a licen\xE7a de suporte): v\xEA tudo, atende ningu\xE9m.
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
-  END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  -- Atender o que n\xE3o \xE9 de hoje abriria um atendimento paralelo ao agendado \u2014
-  -- o mesmo motivo que fez o V1 trocar o bot\xE3o conforme o dia.
-  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
-  END IF;
-  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
-  END IF;
-
-  -- Uma sess\xE3o por servi\xE7o do agendamento. \`booking_item_id\` \xE9 a chave de
-  -- idempot\xEAncia: apertar duas vezes (ou duas pessoas ao mesmo tempo) n\xE3o
-  -- duplica nada.
-  FOR v_item IN
-    SELECT ai.id, ai.service_id, ai.assignee_id
-      FROM public.appointment_items ai
-     WHERE ai.booking_id = p_booking
-  LOOP
-    INSERT INTO public.plg_clinical_sessions (
-      tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
-      assignee_id, performed_by_id, service_id, scheduled_for, started_at)
-    SELECT a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
-           coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
-           a.starts_at, now()
-     WHERE NOT EXISTS (
-       SELECT 1 FROM public.plg_clinical_sessions cs
-        WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
-    IF FOUND THEN v_created := v_created + 1; END IF;
-  END LOOP;
-
-  UPDATE public.appointments
-     SET status = 'in_progress', updated_at = now()
-   WHERE id = p_booking AND status <> 'in_progress';
-
-  v_refresh := public.clinical_requirements_refresh(p_booking);
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'sessoes_criadas', v_created,
-    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
-    'regua', v_refresh);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
-`;
-var MIGRATION_006_CONTRATAR_NAO_E_PAGAR = `-- ============================================================================
--- CONTRATAR n\xE3o \xE9 PAGAR
---
--- O passo mais delicado do turno do injetor, e a demonstra\xE7\xE3o do V1 para nele
--- para explicar: *"Mas at\xE9 ent\xE3o ele n\xE3o pagou ainda? N\xE3o pagou \u2014 mas ele vai
--- executar."* Contratar cria a D\xCDVIDA; receber \xE9 papel da recep\xE7\xE3o, em outra
--- tela e outro momento.
---
--- No V1 isto grava \`generated_contracts\` + \`invoices\` + \`invoice_items\`. No V2
--- o documento \xE9 o PEDIDO, e h\xE1 uma porta s\xF3 para abri-lo: \`order_create\` \u2014 a
--- mesma que o PDV, o totem e a agenda usam. Nada aqui escreve uma linha de
--- fatura \xE0 m\xE3o; a cobran\xE7a nasce depois, quando o atendimento fecha.
---
--- Por que uma fun\xE7\xE3o e n\xE3o tr\xEAs chamadas do app: contratar \xE9 abrir o pedido,
--- ligar cada sess\xE3o \xE0 sua linha e reapurar a r\xE9gua. Pedido aberto com a sess\xE3o
--- solta \xE9 um atendimento que cobra e n\xE3o sabe o que executou.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_contract_services(p_booking uuid, p_lines jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_order uuid; v_line jsonb; v_item uuid; v_n int := 0;
-  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_marcado');
-  END IF;
-
-  -- As linhas, no formato que \`order_create\` j\xE1 entende.
-  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-  LOOP
-    v_rpc_lines := v_rpc_lines || jsonb_build_object(
-      'product_id', v_line ->> 'service_id',
-      'name', v_line ->> 'name',
-      'quantity', coalesce((v_line ->> 'quantity')::numeric, 1),
-      'unit_price', coalesce((v_line ->> 'unit_price')::numeric, 0),
-      'sort_order', v_idx);
-    v_idx := v_idx + 1;
-  END LOOP;
-
-  -- O pedido do atendimento. \`idempotency_key\` pelo agendamento: dois toques
-  -- no "Contratar" n\xE3o abrem duas contas para a mesma visita.
-  IF a.order_id IS NULL THEN
-    v_order := public.order_create(
-      p_kind => 'appointment',
-      p_lines => v_rpc_lines,
-      p_party_id => a.party_id,
-      p_unit_id => a.unit_id,
-      p_status => 'scheduled',
-      p_assignee_id => a.assignee_id,
-      p_metadata => jsonb_build_object('agenda', jsonb_build_object('booking_id', p_booking), 'source', 'clinical:contratacao'),
-      p_idempotency_key => 'clinical-contract:' || p_booking::text);
-    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = p_booking;
-  ELSE
-    -- Pedido j\xE1 existe (a agenda abriu na marca\xE7\xE3o): acrescenta o que falta.
-    v_order := a.order_id;
-    v_idx := coalesce((SELECT max(i.sort_order) + 1 FROM public.items i WHERE i.order_id = v_order), 0);
-    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-    LOOP
-      INSERT INTO public.items (tenant_id, unit_id, order_id, product_id, name, quantity, unit_price, total, sort_order)
-      VALUES (a.tenant_id, a.unit_id, v_order, (v_line ->> 'service_id')::uuid, v_line ->> 'name',
-              coalesce((v_line ->> 'quantity')::numeric, 1),
-              coalesce((v_line ->> 'unit_price')::numeric, 0),
-              coalesce((v_line ->> 'quantity')::numeric, 1) * coalesce((v_line ->> 'unit_price')::numeric, 0),
-              v_idx);
-      v_idx := v_idx + 1;
-    END LOOP;
-  END IF;
-
-  -- Cada sess\xE3o passa a apontar a SUA linha. Sem isto o pedido cobra e o
-  -- atendimento n\xE3o sabe o que executou \u2014 e a bola "Conta do atendimento"
-  -- nunca fecha, porque \xE9 exatamente este v\xEDnculo que ela procura.
-  UPDATE public.plg_clinical_sessions cs
-     SET order_item_id = i.id,
-         status = CASE WHEN cs.status IN ('quoted', 'pending', 'scheduled') THEN 'contracted' ELSE cs.status END,
-         updated_at = now()
-    FROM public.items i
-   WHERE cs.booking_id = p_booking
-     AND cs.order_item_id IS NULL
-     AND i.order_id = v_order
-     AND i.product_id = cs.service_id
-     AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions o
-                      WHERE o.order_item_id = i.id AND o.id <> cs.id);
-  GET DIAGNOSTICS v_n = ROW_COUNT;
-
-  RETURN jsonb_build_object(
-    'ok', true, 'order_id', v_order, 'sessoes_ligadas', v_n,
-    'total', (SELECT coalesce(sum(i.total), 0) FROM public.items i WHERE i.order_id = v_order),
-    'regua', public.clinical_requirements_refresh(p_booking));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_contract_services(uuid, jsonb) TO authenticated;
-`;
-var MIGRATION_007_FINALIZAR_ACENDE_O_BALCAO = `-- ============================================================================
--- FINALIZAR acende o balc\xE3o
---
--- O \xFAltimo gesto do profissional \xE9 o PRIMEIRO da recep\xE7\xE3o. No V1, o instante em
--- que o atendimento vai para \`completed\` sem \`checkout_confirmed_at\` acende o
--- rodap\xE9 do balc\xE3o \u2014 com contador, pulso e bipe.
---
--- Duas decis\xF5es do V1 que v\xEAm junto, e que s\xE3o o oposto uma da outra:
---
---   \xB7 o aviso de servi\xE7os n\xE3o executados AVISA E DEIXA PASSAR. Travar criaria
---     um atendimento sem sa\xEDda pela interface; quem n\xE3o executou cancela o item
---     na conta do cliente. Por isso \`p_force\`: a primeira chamada devolve a
---     lista, a segunda executa.
---   \xB7 a exig\xEAncia que bloqueia TERMINAR (\`blocks_finish\`) \xE9 outra coisa, e essa
---     trava de verdade \u2014 \xE9 o termo de sess\xE3o do V1, que existe para n\xE3o haver
---     execu\xE7\xE3o sem assinatura.
---
--- E o que N\xC3O se grava aqui: \`checkout_confirmed_at\`. Ele \xE9 da recep\xE7\xE3o, e \xE9 o
--- que tira o cart\xE3o da fila \u2014 receber e conferir s\xE3o duas coisas.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_attendance_finish(p_booking uuid, p_force boolean DEFAULT false)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_bloqueia jsonb; v_nao_executados jsonb;
-  v_avisados int := 0; v_total numeric := 0; v_cliente text;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-
-  -- A trava de verdade: exig\xEAncia que impede TERMINAR.
-  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', r.kind, 'service_id', r.service_id)), '[]'::jsonb)
-    INTO v_bloqueia
-    FROM public.plg_clinical_requirements r
-   WHERE r.booking_id = p_booking AND r.blocks_finish AND r.status = 'pending';
-  IF jsonb_array_length(v_bloqueia) > 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'exigencia_bloqueia', 'itens', v_bloqueia);
-  END IF;
-
-  -- O aviso que n\xE3o trava: servi\xE7os contratados e ainda n\xE3o executados.
-  SELECT coalesce(jsonb_agg(p.name ORDER BY p.name), '[]'::jsonb) INTO v_nao_executados
-    FROM public.plg_clinical_sessions cs
-    JOIN public.products p ON p.id = cs.service_id
-   WHERE cs.booking_id = p_booking AND cs.status <> 'executed';
-  IF jsonb_array_length(v_nao_executados) > 0 AND NOT coalesce(p_force, false) THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'servicos_nao_executados', 'itens', v_nao_executados);
-  END IF;
-
-  -- "Finalizar agora registra estes servi\xE7os como executados" \u2014 texto do V1.
-  UPDATE public.plg_clinical_sessions
-     SET status = 'executed', ended_at = coalesce(ended_at, now()), updated_at = now()
-   WHERE booking_id = p_booking AND status <> 'executed';
-
-  UPDATE public.appointments
-     SET status = 'completed', updated_at = now()
-   WHERE id = p_booking;
-
-  -- Congela a trilha: depois de encerrado, a r\xE9gua n\xE3o se reapura.
-  PERFORM public.clinical_requirements_refresh(p_booking, true);
-
-  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = a.order_id;
-  SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
-
-  -- O BALC\xC3O ACENDE.
-  --
-  -- Quem recebe: a recep\xE7\xE3o da conta. Onde n\xE3o houver ningu\xE9m com o papel de
-  -- recep\xE7\xE3o \u2014 e \xE9 o caso do tenant migrado, com 0 membros nele \u2014, cai para
-  -- gerente e dono. Um aviso que n\xE3o chega a ningu\xE9m deixaria a conta parada
-  -- sem que nada na tela dissesse por qu\xEA.
-  WITH alvo AS (
-    SELECT m.user_id
-      FROM app.memberships m
-      JOIN app.roles r ON r.id = m.role_id
-     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
-       AND r.key IN ('recepcao', 'reception')
-    UNION ALL
-    SELECT m.user_id
-      FROM app.memberships m
-      JOIN app.roles r ON r.id = m.role_id
-     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
-       AND r.key IN ('owner', 'manager')
-       AND NOT EXISTS (
-         SELECT 1 FROM app.memberships m2 JOIN app.roles r2 ON r2.id = m2.role_id
-          WHERE m2.tenant_id = a.tenant_id AND coalesce(m2.active, true)
-            AND r2.key IN ('recepcao', 'reception'))
-  )
-  INSERT INTO public.notifications (tenant_id, user_id, title, body, type, link, subject_type, subject_id)
-  SELECT a.tenant_id, alvo.user_id,
-         'Checkout pendente',
-         coalesce(v_cliente, 'Cliente') || ' terminou o atendimento'
-           -- O dinheiro escrito como o Brasil escreve. \`to_char\` usa o
-           -- \`lc_numeric\` do BANCO para o grupo e a v\xEDrgula, e o cluster est\xE1
-           -- em C: sa\xEDa "R$ 999.00" no aviso de uma recep\xE7\xE3o brasileira. A
-           -- troca \xE9 feita \xE0 m\xE3o para n\xE3o depender de locale nenhum.
-           || CASE WHEN v_total > 0 THEN ' \xB7 R$ ' ||
-                replace(replace(replace(to_char(v_total, 'FM999G999G999D00'), ',', '\xA7'), '.', ','), '\xA7', '.')
-              ELSE '' END,
-         'checkout_pendente', '#/checkin', 'appointment', p_booking
-    FROM alvo
-  ON CONFLICT (user_id, subject_type, subject_id, type) WHERE subject_id IS NOT NULL DO NOTHING;
-  GET DIAGNOSTICS v_avisados = ROW_COUNT;
-
-  RETURN jsonb_build_object(
-    'ok', true, 'avisados', v_avisados, 'total', v_total,
-    'executados', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking AND status = 'executed'));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_attendance_finish(uuid, boolean) TO authenticated;
-`;
-var MIGRATION_008_CONFERIR_NAO_E_RECEBER = `-- ============================================================================
--- CONFERIR n\xE3o \xE9 RECEBER
---
--- O V1 \xE9 expl\xEDcito: *"Receber move dinheiro; concluir checkout \xE9 a recep\xE7\xE3o
--- dizendo 'conferi a sess\xE3o'. O cart\xE3o fica na fila enquanto houver valor em
--- aberto OU checkout por confirmar."* S\xE3o duas coisas, e junt\xE1-las numa s\xF3
--- faria a fila esvaziar quando o dinheiro entra \u2014 mesmo que ningu\xE9m tenha
--- olhado o que foi executado.
---
--- \`checkout_confirmed_at\` mora no \`metadata->'agenda'\` do agendamento, que \xE9
--- onde o ETL do V1 o deixou: 332 atendimentos migrados j\xE1 o carregam ali.
--- Escrever numa coluna nova faria o hist\xF3rico e o presente responderem em
--- lugares diferentes.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_checkout_confirm(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_aberto numeric := 0;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.status, ap.order_id, ap.metadata
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  -- Quem confere \xE9 quem est\xE1 no balc\xE3o. Diferente de iniciar o atendimento,
-  -- aqui N\xC3O se exige ser o profissional do agendamento: conferir \xE9 da
-  -- recep\xE7\xE3o, e a recep\xE7\xE3o n\xE3o atende ningu\xE9m.
-  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
-  v_person := public.current_person_id();
-
-  IF a.status <> 'completed' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_terminou');
-  END IF;
-  IF a.metadata -> 'agenda' ->> 'checkout_confirmed_at' IS NOT NULL THEN
-    RETURN jsonb_build_object('ok', true, 'ja_confirmado', true);
-  END IF;
-
-  -- S\xF3 o ramo \`agenda\` \xE9 reescrito, e ele \xE9 reescrito a partir do que j\xE1
-  -- estava l\xE1: o \`||\` sobre o objeto inteiro apagaria o que o ETL do V1
-  -- deixou no metadata do agendamento.
-  UPDATE public.appointments ap
-     SET metadata = coalesce(ap.metadata, '{}'::jsonb)
-           || jsonb_build_object('agenda',
-                coalesce(ap.metadata -> 'agenda', '{}'::jsonb)
-                || jsonb_build_object(
-                     'checkout_confirmed_at', to_jsonb(now()),
-                     'checkout_confirmed_by', to_jsonb(coalesce(v_person::text, auth.uid()::text)))),
-         updated_at = now()
-   WHERE ap.id = p_booking;
-
-  -- O aviso cumpriu o papel dele. Deix\xE1-lo n\xE3o lido faria o sino cobrar uma
-  -- confer\xEAncia que j\xE1 aconteceu.
-  UPDATE public.notifications
-     SET read = true
-   WHERE subject_type = 'appointment' AND subject_id = p_booking AND NOT read;
-
-  SELECT coalesce(sum(i.total), 0) INTO v_aberto FROM public.items i WHERE i.order_id = a.order_id;
-
-  RETURN jsonb_build_object('ok', true, 'total', v_aberto);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_checkout_confirm(uuid) TO authenticated;
-`;
-var MIGRATION_009_O_BOTAO_DE_COBRAR_COBRA = `-- ============================================================================
--- O bot\xE3o de cobrar COBRA
---
--- SINTOMA, visto na tela: a conta do cliente mostra "Este atendimento ainda n\xE3o
--- tem cobran\xE7a \xB7 **Gerar recebimento**", e o clique n\xE3o faz nada. Nenhum
--- movimento nasce, nenhuma mensagem aparece. O bot\xE3o existe porque o painel o
--- oferece, e quem o liga \xE9 o APP hospedeiro \u2014 que neste app n\xE3o liga.
---
--- Bot\xE3o morto \xE9 pior que bot\xE3o ausente: quem clica confia no bot\xE3o.
---
--- O caminho do dinheiro no V2 \xE9 um s\xF3: o receb\xEDvel \xE9 levantado quando o PEDIDO
--- FECHA (\`orders_raise_receivable_on_close\`). Ent\xE3o cobrar \xE9 fechar o pedido do
--- atendimento \u2014 e n\xE3o escrever fatura \xE0 m\xE3o, que \xE9 o que a regra do SDK pro\xEDbe.
---
--- \xC9 aqui, e n\xE3o na contrata\xE7\xE3o, porque o V1 separa as duas coisas: contratar
--- cria a d\xEDvida; cobrar \xE9 da recep\xE7\xE3o, depois de conferir o que foi executado.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_checkout_charge(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_linhas int; v_total numeric; v_mov int;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.status, ap.order_id INTO a
-    FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
-
-  IF a.order_id IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
-  END IF;
-
-  SELECT count(*), coalesce(sum(i.total), 0) INTO v_linhas, v_total
-    FROM public.items i WHERE i.order_id = a.order_id;
-  IF v_linhas = 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
-  END IF;
-
-  -- Idempotente: o pedido j\xE1 fechado devolve o que existe, sem levantar um
-  -- segundo receb\xEDvel para a mesma visita.
-  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
-  IF v_mov > 0 THEN
-    RETURN jsonb_build_object('ok', true, 'ja_cobrado', true, 'total', v_total);
-  END IF;
-
-  UPDATE public.orders SET status = 'completed', updated_at = now()
-   WHERE id = a.order_id AND status <> 'completed';
-
-  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
-  RETURN jsonb_build_object('ok', true, 'total', v_total, 'movimentos', v_mov);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_checkout_charge(uuid) TO authenticated;
-`;
-var MIGRATION_010_A_INDICACAO_VAI_PARA_O_FUNIL = `-- ============================================================================
--- A INDICA\xC7\xC3O vai para o funil
---
--- O V1 escreve, na pr\xF3pria tela da avalia\xE7\xE3o: *"Indique procedimentos ou
--- produtos para o cliente \u2014 eles alimentam as recomenda\xE7\xF5es do CRM e a etapa de
--- or\xE7amento."* E a rede confirma: concluir a avalia\xE7\xE3o faz \`POST
--- opportunity_recommendations\`.
---
--- **Indica\xE7\xE3o n\xE3o \xE9 venda.** \xC9 o que o profissional recomenda; virar cobran\xE7a \xE9
--- outra decis\xE3o, do paciente, na contrata\xE7\xE3o. As duas palavras existem
--- separadas no V1 porque separam dois momentos e duas responsabilidades.
---
--- No V2 a cesta do interesse pende de um NEG\xD3CIO (\`plg_crm_deal_interests.
--- deal_id\` \xE9 NOT NULL). Ent\xE3o a avalia\xE7\xE3o abre \u2014 ou reaproveita \u2014 um neg\xF3cio do
--- cliente e pendura ali o que foi indicado. \xC9 o mesmo desenho do V1, com o
--- vocabul\xE1rio do V2: a indica\xE7\xE3o nasce no atendimento e vive no funil.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_evaluation_complete(p_booking uuid, p_lines jsonb DEFAULT '[]'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_deal uuid; v_line jsonb; v_interest uuid;
-  v_n int := 0; v_resolvidas int := 0; v_cliente text;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-
-  IF jsonb_typeof(p_lines) = 'array' AND jsonb_array_length(p_lines) > 0 THEN
-    SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
-
-    -- O neg\xF3cio do cliente. Reaproveita o que estiver aberto: duas avalia\xE7\xF5es
-    -- no mesmo m\xEAs s\xE3o a mesma conversa, e abrir um funil por atendimento faria
-    -- o quadro do CRM virar hist\xF3rico de agenda.
-    SELECT d.id INTO v_deal FROM public.plg_crm_deals d
-     WHERE d.tenant_id = a.tenant_id AND d.contact_id = a.party_id AND d.status = 'open'
-     ORDER BY d.created_at DESC LIMIT 1;
-
-    IF v_deal IS NULL THEN
-      INSERT INTO public.plg_crm_deals (tenant_id, unit_id, title, contact_id, assigned_to_id, metadata)
-      VALUES (a.tenant_id, a.unit_id,
-              'Avalia\xE7\xE3o \u2014 ' || coalesce(v_cliente, 'cliente'), a.party_id, a.assignee_id,
-              jsonb_build_object('source', 'clinical:avaliacao', 'booking_id', p_booking))
-      RETURNING id INTO v_deal;
-    END IF;
-
-    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-    LOOP
-      -- Idempotente por (neg\xF3cio, produto): indicar duas vezes o mesmo
-      -- procedimento \xE9 corrigir a quantidade, n\xE3o criar uma segunda indica\xE7\xE3o.
-      SELECT i.id INTO v_interest FROM public.plg_crm_deal_interests i
-       WHERE i.deal_id = v_deal AND i.product_id = (v_line ->> 'service_id')::uuid;
-
-      IF v_interest IS NULL THEN
-        INSERT INTO public.plg_crm_deal_interests
-          (tenant_id, unit_id, deal_id, product_id, quantity, origin, status, notes, metadata)
-        VALUES (a.tenant_id, a.unit_id, v_deal, (v_line ->> 'service_id')::uuid,
-                greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1),
-                'indication', 'open', nullif(v_line ->> 'notes', ''),
-                jsonb_build_object('source', 'clinical:avaliacao', 'booking_id', p_booking))
-        RETURNING id INTO v_interest;
-        v_n := v_n + 1;
-      ELSE
-        UPDATE public.plg_crm_deal_interests
-           SET quantity = greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1), updated_at = now()
-         WHERE id = v_interest;
-      END IF;
-
-      INSERT INTO public.plg_crm_deal_interest_appointments (tenant_id, unit_id, appointment_id, interest_id)
-      SELECT a.tenant_id, a.unit_id, p_booking, v_interest
-       WHERE NOT EXISTS (SELECT 1 FROM public.plg_crm_deal_interest_appointments x
-                          WHERE x.appointment_id = p_booking AND x.interest_id = v_interest);
-    END LOOP;
-  END IF;
-
-  -- A bola da avalia\xE7\xE3o fecha apontando a SESS\xC3O em que ela aconteceu. O V1
-  -- resolve pelo v\xEDnculo com a execu\xE7\xE3o da avalia\xE7\xE3o; aqui a avalia\xE7\xE3o \xE9 este
-  -- atendimento, e o que ela deixa registrado \xE9 o que ele indicou.
-  UPDATE public.plg_clinical_requirements r
-     SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = r.session_id,
-         resolved_via = 'attendance', resolved_at = now(), updated_at = now()
-   WHERE r.booking_id = p_booking AND r.kind = 'evaluation' AND r.status = 'pending'
-     AND r.frozen_at IS NULL AND r.session_id IS NOT NULL;
-  GET DIAGNOSTICS v_resolvidas = ROW_COUNT;
-
-  RETURN jsonb_build_object('ok', true, 'deal_id', v_deal, 'indicacoes', v_n, 'bolas_fechadas', v_resolvidas);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_evaluation_complete(uuid, jsonb) TO authenticated;
-`;
-var MIGRATION_011_INTERESSE_E_INDICACAO_NA_MESMA_LINHA = `-- ============================================================================
--- INTERESSE e INDICA\xC7\xC3O na MESMA LINHA
---
--- O desfecho do desenho do V1, e a captura que o documenta mostra a linha
--- inteira:
---
---     \xC1cido Hialur\xF4nico \u2014 R$ 999,00
---     Interesse do cliente \xB7 Indicado pelo profissional
---
--- S\xE3o tr\xEAs palavras e tr\xEAs momentos: **interesse** \xE9 o que o cliente pediu ao
--- marcar; **indica\xE7\xE3o** \xE9 o que o profissional recomendou na avalia\xE7\xE3o;
--- **contrata\xE7\xE3o** \xE9 o que virou cobran\xE7a. O mesmo servi\xE7o pode carregar as duas
--- primeiras \u2014 e a\xED ele aparece UMA vez, com as duas origens somadas no r\xF3tulo.
---
--- Duas linhas para o mesmo procedimento fariam a recep\xE7\xE3o cobrar duas vezes; e
--- esconder a origem faria o paciente ouvir "o senhor pediu" sobre algo que foi
--- recomendado. Por isso a fus\xE3o \xE9 do BANCO, e n\xE3o de cada tela que precisar
--- dela.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_contract_candidates(p_booking uuid)
-RETURNS TABLE (
-  service_id uuid,
-  name text,
-  price numeric,
-  quantity numeric,
-  from_interest boolean,
-  from_indication boolean,
-  already_contracted boolean
-) LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-  WITH alvo AS (
-    SELECT ap.id, ap.tenant_id, ap.party_id, ap.order_id FROM public.appointments ap WHERE ap.id = p_booking
-  ),
-  -- O que o cliente pediu ao marcar.
-  interesse AS (
-    SELECT ai.service_id, max(ai.name) AS name, max(ai.price) AS price, count(*)::numeric AS qtd
-      FROM public.appointment_items ai, alvo
-     WHERE ai.booking_id = alvo.id AND ai.service_id IS NOT NULL
-     GROUP BY ai.service_id
-  ),
-  -- O que o profissional recomendou \u2014 deste atendimento ou do neg\xF3cio aberto
-  -- do cliente, que \xE9 onde a avalia\xE7\xE3o pendura o que indicou.
-  indicacao AS (
-    SELECT i.product_id AS service_id, max(i.quantity) AS qtd
-      FROM public.plg_crm_deal_interests i
-      JOIN public.plg_crm_deals d ON d.id = i.deal_id, alvo
-     WHERE i.tenant_id = alvo.tenant_id AND i.status = 'open'
-       AND (d.contact_id = alvo.party_id
-            OR EXISTS (SELECT 1 FROM public.plg_crm_deal_interest_appointments x
-                        WHERE x.interest_id = i.id AND x.appointment_id = alvo.id))
-     GROUP BY i.product_id
-  ),
-  -- O que j\xE1 virou cobran\xE7a nesta visita: aparece marcado, n\xE3o some \u2014 sumir
-  -- faria a lista mentir sobre o que foi combinado.
-  contratado AS (
-    SELECT it.product_id AS service_id FROM public.items it, alvo
-     WHERE alvo.order_id IS NOT NULL AND it.order_id = alvo.order_id AND it.product_id IS NOT NULL
-  )
-  SELECT
-    coalesce(i.service_id, n.service_id) AS service_id,
-    coalesce(i.name, p.name) AS name,
-    coalesce(nullif(i.price, 0), p.price, 0) AS price,
-    greatest(coalesce(i.qtd, 0), coalesce(n.qtd, 0), 1) AS quantity,
-    i.service_id IS NOT NULL AS from_interest,
-    n.service_id IS NOT NULL AS from_indication,
-    EXISTS (SELECT 1 FROM contratado c WHERE c.service_id = coalesce(i.service_id, n.service_id)) AS already_contracted
-  FROM interesse i
-  FULL OUTER JOIN indicacao n ON n.service_id = i.service_id
-  LEFT JOIN public.products p ON p.id = coalesce(i.service_id, n.service_id)
-  ORDER BY 2;
-$fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_contract_candidates(uuid) TO authenticated;
-`;
-var MIGRATION_012_O_QUE_FOI_USADO_ESPERA_APROVACAO = `-- ============================================================================
--- O QUE FOI USADO espera aprova\xE7\xE3o
---
--- A bola de produtos do V1, e a frase que a define: *"Ele vem tudo pra c\xE1
--- primeiro. Vem pra aprova\xE7\xE3o de dispensa."* **Nada baixa aqui.** O consumo
--- declarado pelo profissional cai na fila da Auditoria de Uso, e \xE9 l\xE1 que
--- algu\xE9m confirma \u2014 ou corrige a quantidade lan\xE7ada errada.
---
--- Registrar consumo baixando estoque na hora seria transformar a mem\xF3ria de
--- quem atende em movimento cont\xE1bil sem confer\xEAncia, que \xE9 exatamente o que a
--- auditoria existe para evitar.
---
--- \`is_audited = false\` \xE9 o estado inicial, e \xE9 o que p\xF5e a linha na fila.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_products_record(p_booking uuid, p_lines jsonb DEFAULT '[]'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_line jsonb; v_session uuid; v_n int := 0; v_marcadas int := 0;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.assignee_id, ap.status
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-
-  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_lines, '[]'::jsonb))
-  LOOP
-    -- A sess\xE3o do SERVI\xC7O que consumiu. O V1 desenha um bloco por servi\xE7o
-    -- justamente porque a mesma seringa gasta em procedimentos diferentes, e
-    -- juntar tudo num monte perde de qual execu\xE7\xE3o veio.
-    SELECT cs.id INTO v_session FROM public.plg_clinical_sessions cs
-     WHERE cs.booking_id = p_booking AND cs.service_id = (v_line ->> 'service_id')::uuid
-     ORDER BY cs.created_at LIMIT 1;
-    IF v_session IS NULL THEN CONTINUE; END IF;
-
-    INSERT INTO public.plg_clinical_session_products
-      (tenant_id, unit_id, session_id, product_id, assignee_id, used_quantity, used_unit_id, executed_on, is_audited)
-    SELECT a.tenant_id, a.unit_id, v_session, (v_line ->> 'product_id')::uuid, v_person,
-           greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 0),
-           nullif(v_line ->> 'unit_id', '')::uuid, current_date, false
-     WHERE NOT EXISTS (
-       SELECT 1 FROM public.plg_clinical_session_products sp
-        WHERE sp.session_id = v_session AND sp.product_id = (v_line ->> 'product_id')::uuid);
-    IF FOUND THEN
-      v_n := v_n + 1;
-    ELSE
-      UPDATE public.plg_clinical_session_products
-         SET used_quantity = greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 0), updated_at = now()
-       WHERE session_id = v_session AND product_id = (v_line ->> 'product_id')::uuid AND NOT is_audited;
-    END IF;
-  END LOOP;
-
-  -- Conferido \xE9 conferido, mesmo que n\xE3o tenha sido usado nada: "n\xE3o usei
-  -- produto neste procedimento" \xE9 uma resposta, e sem poder d\xE1-la a bola ficaria
-  -- pendente para sempre em quem n\xE3o gasta insumo.
-  UPDATE public.plg_clinical_sessions
-     SET products_initialized = true, updated_at = now()
-   WHERE booking_id = p_booking AND coalesce(products_initialized, false) = false;
-  GET DIAGNOSTICS v_marcadas = ROW_COUNT;
-
-  RETURN jsonb_build_object(
-    'ok', true, 'lancados', v_n, 'sessoes_conferidas', v_marcadas,
-    'regua', public.clinical_requirements_refresh(p_booking));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_products_record(uuid, jsonb) TO authenticated;
-`;
-var MIGRATION_013_O_QUE_COUBER_HOJE = `-- ============================================================================
--- O QUE COUBER HOJE
---
--- *"Marque os servi\xE7os que ser\xE3o executados agora. Os demais ficam contratados
--- para execu\xE7\xE3o em outro atendimento."* \xC9 o di\xE1logo que o V1 abre depois da
--- contrata\xE7\xE3o, e ele existe por causa de uma frase da demonstra\xE7\xE3o: *"o labial
--- veio com uma festa amanh\xE3, n\xE3o quero ficar com o l\xE1bio roxo"*.
---
--- \xC9 este passo que separa **contratado** de **executado** \u2014 e \xE9 dele que nasce
--- o saldo *a executar* na conta do cliente. Sem ele, contratar tr\xEAs sess\xF5es
--- significaria executar tr\xEAs sess\xF5es no mesmo dia, o que n\xE3o \xE9 como uma cl\xEDnica
--- funciona.
---
--- O que N\xC3O se executa hoje n\xE3o vira pend\xEAncia do atendimento: fica contratado,
--- pago ou a pagar, esperando outra data.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_execute_services(p_booking uuid, p_service_ids uuid[])
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_executadas int := 0; v_adiadas int := 0;
-BEGIN
-  SELECT ap.id, ap.assignee_id, ap.status INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-
-  UPDATE public.plg_clinical_sessions cs
-     SET status = 'executed', ended_at = coalesce(cs.ended_at, now()), updated_at = now()
-   WHERE cs.booking_id = p_booking
-     AND cs.service_id = ANY (coalesce(p_service_ids, ARRAY[]::uuid[]))
-     AND cs.status <> 'executed';
-  GET DIAGNOSTICS v_executadas = ROW_COUNT;
-
-  -- O que ficou de fora volta a CONTRATADO \u2014 e n\xE3o a pendente: foi combinado e
-  -- continua combinado, s\xF3 que para outra data. Desmarcar depois de ter
-  -- executado por engano \xE9 o caso que esta linha resolve.
-  UPDATE public.plg_clinical_sessions cs
-     SET status = 'contracted', ended_at = NULL, updated_at = now()
-   WHERE cs.booking_id = p_booking
-     AND NOT (cs.service_id = ANY (coalesce(p_service_ids, ARRAY[]::uuid[])))
-     AND cs.status = 'executed';
-  GET DIAGNOSTICS v_adiadas = ROW_COUNT;
-
-  RETURN jsonb_build_object('ok', true, 'executadas', v_executadas, 'adiadas', v_adiadas);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_execute_services(uuid, uuid[]) TO authenticated;
-`;
-var MIGRATION_014_O_PAGO_A_EXECUTAR_DEIXA_DE_SER_INVISIVEL = `-- ============================================================================
--- O "PAGO A EXECUTAR" deixa de ser invis\xEDvel
---
--- O tipo \`ClientAccount\` do financeiro traz este coment\xE1rio, escrito quando o
--- porte come\xE7ou:
---
---   "\`paidToExecute\` (o 'pago a executar' do V1) \xE9 o valor j\xE1 recebido de
---    servi\xE7o ainda n\xE3o prestado: num sal\xE3o isso \xE9 PASSIVO, n\xE3o receita. Fica
---    opcional porque o V2 ainda n\xE3o tem o eixo de EXECU\xC7\xC3O \u2014 modela pagamento e
---    n\xE3o modela entrega \u2014, e um zero fixo ali mentiria sobre uma d\xEDvida."
---
--- O eixo passou a existir: \`plg_clinical_sessions.status\` separa **contratado**
--- de **executado**, e a etapa "o que couber hoje" \xE9 quem move uma para a outra.
--- Ent\xE3o a conta pode responder \u2014 e a regra de honestidade se inverte: agora
--- OMITIR o n\xFAmero esconderia a d\xEDvida.
---
--- A vista \xE9 do plugin cl\xEDnico porque o dado \xE9 dele. O financeiro l\xEA se ela
--- existir; onde o prontu\xE1rio n\xE3o est\xE1 instalado, a conta continua sem o cart\xE3o,
--- que \xE9 a resposta certa para quem n\xE3o tem execu\xE7\xE3o para acompanhar.
--- ============================================================================
-
-CREATE OR REPLACE VIEW public.v_clinical_to_execute AS
-WITH sessao AS (
-  SELECT
-    cs.tenant_id,
-    cs.party_id,
-    cs.order_item_id,
-    cs.status,
-    i.order_id,
-    coalesce(i.total, 0) AS item_total
-  FROM public.plg_clinical_sessions cs
-  JOIN public.items i ON i.id = cs.order_item_id
-  WHERE cs.party_id IS NOT NULL
-    AND cs.status IN ('contracted', 'quoted', 'in_service', 'scheduled', 'pending')
-),
--- Quanto do PEDIDO j\xE1 foi recebido, em propor\xE7\xE3o: o pagamento \xE9 por parcela e
--- n\xE3o por item, ent\xE3o a fatia paga de cada item \xE9 a fatia paga do pedido.
-pago AS (
-  SELECT m.invoice_id AS order_id,
-         sum(coalesce(m.paid_amount, 0)) AS pago,
-         nullif(sum(coalesce(m.amount, 0)), 0) AS total
-    FROM public.plg_financial_movements m
-   WHERE m.direction = 'credit'
-   GROUP BY m.invoice_id
-)
-SELECT
-  s.tenant_id,
-  s.party_id,
-  sum(s.item_total * coalesce(p.pago / p.total, 0))::numeric(14,2) AS paid_to_execute,
-  sum(s.item_total * (1 - coalesce(p.pago / p.total, 0)))::numeric(14,2) AS open_to_execute,
-  count(*)::int AS sessions_to_execute
-FROM sessao s
-LEFT JOIN pago p ON p.order_id = s.order_id
-GROUP BY s.tenant_id, s.party_id;
-
-COMMENT ON VIEW public.v_clinical_to_execute IS
-  'O que o cliente j\xE1 contratou e ainda N\xC3O foi executado, separado em pago e em aberto. O "pago a executar" do V1 \xE9 passivo: dinheiro recebido de servi\xE7o que a casa ainda deve prestar.';
-
-GRANT SELECT ON public.v_clinical_to_execute TO authenticated;
-`;
-var MIGRATION_015_A_REVISAO_APONTA_O_QUE_REVISA = `-- ============================================================================
--- A REVIS\xC3O aponta O QUE ela revisa
---
--- Revis\xE3o \xE9 o retorno de um procedimento que j\xE1 foi feito \u2014 e ela s\xF3 significa
--- alguma coisa se disser DE QUAL. Sem o v\xEDnculo, o hist\xF3rico do paciente fica
--- com um "Revis\xE3o" solto, e ningu\xE9m consegue responder, meses depois, o que foi
--- revisado nem se ainda estava no prazo.
---
--- Por isso a exig\xEAncia \`revision_link\` do V1 \xE9 a \xFAnica que trava as DUAS pontas:
--- \`blocks_start\` e \`blocks_finish\`. N\xE3o se come\xE7a uma revis\xE3o sem saber do qu\xEA,
--- e n\xE3o se encerra sem ter dito.
---
--- O modal do V1 mudou em 21/09 (\`2e1a119ef\`): passou a listar **todo servi\xE7o
--- executado**, com o **prazo \xE0 vista**, em vez de s\xF3 os candidatos filtrados \u2014
--- porque quem atende sabe reconhecer o procedimento na lista, e um filtro
--- silencioso esconde justamente o caso fora do padr\xE3o.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_revision_candidates(p_booking uuid)
-RETURNS TABLE (
-  session_id uuid,
-  service_id uuid,
-  service_name text,
-  executed_on timestamptz,
-  deadline_days integer,
-  days_since integer,
-  within_deadline boolean
-) LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-  WITH alvo AS (
-    SELECT ap.tenant_id, ap.party_id FROM public.appointments ap WHERE ap.id = p_booking
-  )
-  SELECT
-    cs.id,
-    cs.service_id,
-    p.name,
-    coalesce(cs.ended_at, cs.scheduled_for) AS executed_on,
-    rev.deadline_days,
-    (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date)::int AS days_since,
-    -- Prazo ausente n\xE3o vira "fora do prazo": vira SEM prazo, e a tela diz isso.
-    CASE WHEN rev.deadline_days IS NULL THEN NULL
-         ELSE (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date) <= rev.deadline_days
-    END AS within_deadline
-  FROM public.plg_clinical_sessions cs
-  JOIN alvo a ON a.tenant_id = cs.tenant_id AND a.party_id = cs.party_id
-  LEFT JOIN public.products p ON p.id = cs.service_id
-  LEFT JOIN LATERAL (
-    SELECT r.deadline_days FROM public.plg_clinical_service_revisions r
-     WHERE r.tenant_id = cs.tenant_id AND r.service_id = cs.service_id
-     ORDER BY r.revision_number LIMIT 1
-  ) rev ON true
-  WHERE cs.status = 'executed'
-    AND cs.booking_id IS DISTINCT FROM p_booking
-  ORDER BY coalesce(cs.ended_at, cs.scheduled_for) DESC NULLS LAST
-  LIMIT 50;
-$fn$;
-
-CREATE OR REPLACE FUNCTION public.clinical_link_revision(p_session uuid, p_parent_session uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  s record; v_person uuid; v_booking uuid;
-BEGIN
-  SELECT cs.id, cs.booking_id, cs.tenant_id, cs.party_id INTO s
-    FROM public.plg_clinical_sessions cs WHERE cs.id = p_session;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-
-  -- O original tem de ser do MESMO paciente. Revisar o procedimento de outra
-  -- pessoa n\xE3o \xE9 engano de digita\xE7\xE3o: \xE9 prontu\xE1rio trocado.
-  IF NOT EXISTS (
-    SELECT 1 FROM public.plg_clinical_sessions p
-     WHERE p.id = p_parent_session AND p.party_id = s.party_id AND p.tenant_id = s.tenant_id
-  ) THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'original_de_outro_paciente');
-  END IF;
-
-  UPDATE public.plg_clinical_sessions
-     SET parent_session_id = p_parent_session, updated_at = now()
-   WHERE id = p_session;
-
-  v_booking := s.booking_id;
-  RETURN jsonb_build_object('ok', true, 'regua', public.clinical_requirements_refresh(v_booking));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_revision_candidates(uuid) TO authenticated;
-GRANT EXECUTE ON FUNCTION public.clinical_link_revision(uuid, uuid) TO authenticated;
-`;
-var MIGRATION_016_A_COMPRA_ANTECIPADA_NAO_TEM_AGENDAMENTO_ATRAS = `-- ============================================================================
--- A COMPRA ANTECIPADA n\xE3o tem agendamento atr\xE1s
---
--- O caso que a demonstra\xE7\xE3o do V1 narra: *"T\xE1 na promo\xE7\xE3o, vou comprar esse
--- Botox e deixar guardado."* A recep\xE7\xE3o abre **Contas a Receber \u2192 Inserir**,
--- escolhe o servi\xE7o, aplica o desconto combinado e recebe \u2014 **sem agendamento,
--- sem contrato e sem proposta**. O V1 \xE9 expl\xEDcito: *"N\xE3o precisa de contrato?
--- N\xE3o. N\xE3o precisa de proposta? N\xE3o."*
---
--- O efeito aparece na CONTA DA CLIENTE: um item **a executar**, pago, esperando
--- o dia. \xC9 por isso que ele \xE9 passivo \u2014 a casa recebeu e ainda deve prestar \u2014,
--- e \xE9 por isso que ele precisa nascer como SESS\xC3O: sem sess\xE3o, "a executar" n\xE3o
--- existe como estado, e o dinheiro entraria como receita de um servi\xE7o que
--- ningu\xE9m fez.
---
--- Sess\xE3o sem \`booking_id\` \xE9 o que distingue esta compra de um atendimento: ela
--- ainda n\xE3o tem dia. Ganha um quando for agendada.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_prepay_services(p_party uuid, p_lines jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  v_tenant uuid; v_unit uuid; v_order uuid; v_line jsonb;
-  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0; v_sessoes int := 0; v_total numeric;
-BEGIN
-  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
-  v_tenant := app.current_tenant_id();
-  IF v_tenant IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_tenant'); END IF;
-  IF NOT EXISTS (SELECT 1 FROM public.people p WHERE p.id = p_party AND p.tenant_id = v_tenant) THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'cliente_nao_encontrado');
-  END IF;
-  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_escolhido');
-  END IF;
-
-  v_unit := app.requested_unit();
-
-  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-  LOOP
-    v_rpc_lines := v_rpc_lines || jsonb_build_object(
-      'product_id', v_line ->> 'service_id',
-      'name', v_line ->> 'name',
-      'quantity', greatest(coalesce((v_line ->> 'quantity')::numeric, 1), 1),
-      'unit_price', greatest(coalesce((v_line ->> 'unit_price')::numeric, 0), 0),
-      'sort_order', v_idx);
-    v_idx := v_idx + 1;
-  END LOOP;
-
-  v_order := public.order_create(
-    p_kind => 'sale',
-    p_lines => v_rpc_lines,
-    p_party_id => p_party,
-    p_unit_id => v_unit,
-    -- Nasce CONFIRMADO e fecha logo abaixo, em dois tempos \u2014 e isso n\xE3o \xE9
-    -- cerim\xF4nia: o gatilho que levanta o receb\xEDvel \xE9 \`AFTER UPDATE OF status\`,
-    -- ent\xE3o um pedido criado j\xE1 \`completed\` **vende sem cobrar**. Medido: a
-    -- primeira vers\xE3o desta fun\xE7\xE3o criou a compra fechada e a conta ficou com
-    -- "a executar" e ZERO cobran\xE7a.
-    -- (\`scheduled\` nem \xE9 aceito para \`sale\`: o contrato de estados do pedido
-    -- permite draft, confirmed, completed e cancelled.)
-    p_status => 'confirmed',
-    p_metadata => jsonb_build_object('source', 'clinical:compra-antecipada'),
-    p_idempotency_key => NULL);
-
-  -- Uma sess\xE3o por item, SEM dia. \xC9 ela que sustenta o "a executar" na conta \u2014
-  -- e o que permite, quando o dia chegar, amarrar a execu\xE7\xE3o ao que j\xE1 foi pago.
-  INSERT INTO public.plg_clinical_sessions
-    (tenant_id, unit_id, status, party_id, service_id, order_item_id)
-  SELECT v_tenant, v_unit, 'contracted', p_party, i.product_id, i.id
-    FROM public.items i
-   WHERE i.order_id = v_order AND i.product_id IS NOT NULL;
-  GET DIAGNOSTICS v_sessoes = ROW_COUNT;
-
-  -- O fechamento, agora como UPDATE: \xE9 ele que dispara
-  -- \`orders_raise_receivable_on_close\` e faz nascer a conta a receber.
-  UPDATE public.orders SET status = 'completed', updated_at = now() WHERE id = v_order;
-
-  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = v_order;
-
-  RETURN jsonb_build_object('ok', true, 'order_id', v_order, 'sessoes', v_sessoes, 'total', v_total);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_prepay_services(uuid, jsonb) TO authenticated;
-`;
-var MIGRATION_017_O_QUE_JA_FOI_PAGO_NAO_SE_COBRA_DE_NOVO = `-- ============================================================================
--- O QUE J\xC1 FOI PAGO n\xE3o se cobra de novo
---
--- A compra antecipada deixa uma sess\xE3o **sem dia**: o Botox comprado na
--- promo\xE7\xE3o, esperando. Quando o dia chega, o atendimento come\xE7ava criando uma
--- sess\xE3o NOVA para o mesmo servi\xE7o \u2014 e a\xED a cliente tinha duas: a que pagou e a
--- que acabou de ser aberta. A primeira ficava "a executar" para sempre, e a
--- segunda entrava na contrata\xE7\xE3o como se nada tivesse sido pago.
---
--- \xC9 a mesma pessoa, o mesmo servi\xE7o e o mesmo dinheiro. Ent\xE3o o in\xEDcio do
--- atendimento ADOTA a sess\xE3o que j\xE1 existe: ela ganha o dia, o profissional e o
--- item do agendamento, e deixa de pender na conta.
---
--- A escolha \xE9 a mais ANTIGA: quem comprou duas vezes executa primeiro o que
--- comprou primeiro \u2014 e \xE9 isso que faz o saldo andar em vez de envelhecer.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_created int := 0; v_adotadas int := 0;
-  v_item record; v_refresh jsonb; v_antiga uuid;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.starts_at
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
-  END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
-  END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
-  END IF;
-  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
-  END IF;
-
-  FOR v_item IN
-    SELECT ai.id, ai.service_id, ai.assignee_id
-      FROM public.appointment_items ai
-     WHERE ai.booking_id = p_booking
-  LOOP
-    -- J\xE1 existe sess\xE3o para este item? (dois toques, duas pessoas ao mesmo tempo)
-    CONTINUE WHEN EXISTS (
-      SELECT 1 FROM public.plg_clinical_sessions cs
-       WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
-
-    -- O QUE FOI COMPRADO ANTES E AINDA N\xC3O SAIU: adota em vez de criar.
-    SELECT cs.id INTO v_antiga
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.tenant_id = a.tenant_id
-       AND cs.party_id = a.party_id
-       AND cs.service_id = v_item.service_id
-       AND cs.booking_id IS NULL
-       AND cs.status IN ('contracted', 'quoted', 'pending')
-     ORDER BY cs.created_at
-     LIMIT 1;
-
-    IF v_antiga IS NOT NULL THEN
-      UPDATE public.plg_clinical_sessions
-         SET booking_id = p_booking,
-             booking_item_id = v_item.id,
-             unit_id = coalesce(a.unit_id, unit_id),
-             assignee_id = coalesce(v_item.assignee_id, a.assignee_id),
-             performed_by_id = v_person,
-             status = 'in_service',
-             scheduled_for = a.starts_at,
-             started_at = coalesce(started_at, now()),
-             updated_at = now()
-       WHERE id = v_antiga;
-      v_adotadas := v_adotadas + 1;
-    ELSE
-      INSERT INTO public.plg_clinical_sessions (
-        tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
-        assignee_id, performed_by_id, service_id, scheduled_for, started_at)
-      VALUES (a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
-              coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
-              a.starts_at, now());
-      v_created := v_created + 1;
-    END IF;
-  END LOOP;
-
-  UPDATE public.appointments
-     SET status = 'in_progress', updated_at = now()
-   WHERE id = p_booking AND status <> 'in_progress';
-
-  v_refresh := public.clinical_requirements_refresh(p_booking);
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'sessoes_criadas', v_created,
-    'sessoes_adotadas', v_adotadas,
-    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
-    'regua', v_refresh);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
-`;
-var MIGRATION_018_O_QUE_FOI_CONTRATADO_VIRA_SESSAO = `-- O que foi contratado vira SESS\xC3O, mesmo sem agendamento atr\xE1s dele.
---
--- A 006 s\xF3 LIGAVA sess\xF5es j\xE1 existentes \xE0s linhas do pedido. Servi\xE7o indicado
--- na avalia\xE7\xE3o e contratado na hora n\xE3o tem sess\xE3o nenhuma para ligar: a conta
--- ficava com "Botox Full Face \xB7 2 \xB7 R$ 2.798,00" e o prontu\xE1rio n\xE3o sabia que
--- havia dois Botox a executar. O dinheiro entrava e a execu\xE7\xE3o sumia \u2014 nem na
--- r\xE9gua, nem em \`v_clinical_to_execute\`, nem no di\xE1logo de "Executar".
---
--- Uma sess\xE3o POR UNIDADE, porque \xE9 assim que a execu\xE7\xE3o acontece: dois Botox
--- contratados s\xE3o duas idas \xE0 cadeira, e executar um hoje n\xE3o pode fechar o
--- outro. O \`booking_id\` \xE9 o do atendimento onde foi contratado \u2014 quem n\xE3o for
--- executado hoje continua \`contracted\`, que \xE9 o estado de "a executar".
-
-CREATE OR REPLACE FUNCTION public.clinical_sessions_for_order(p_booking uuid, p_order uuid)
-RETURNS integer
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path TO ''
-AS $fn$
-DECLARE
-  a       public.appointments%ROWTYPE;
-  v_item  record;
-  v_faltam integer;
-  v_k      integer;
-  v_total  integer := 0;
-BEGIN
-  SELECT * INTO a FROM public.appointments WHERE id = p_booking;
-  IF NOT FOUND THEN RETURN 0; END IF;
-
-  FOR v_item IN
-    SELECT i.id, i.product_id, i.quantity,
-           (SELECT count(*) FROM public.plg_clinical_sessions s WHERE s.order_item_id = i.id) AS ja
-      FROM public.items i
-     WHERE i.order_id = p_order
-       AND i.product_id IS NOT NULL
-  LOOP
-    -- Servi\xE7o, n\xE3o produto: o que se executa numa cadeira.
-    CONTINUE WHEN NOT EXISTS (
-      SELECT 1 FROM public.products p
-       WHERE p.id = v_item.product_id AND p.kind = 'service');
-
-    v_faltam := greatest(0, ceil(coalesce(v_item.quantity, 1))::integer - v_item.ja::integer);
-    FOR v_k IN 1 .. v_faltam LOOP
-      INSERT INTO public.plg_clinical_sessions
-        (tenant_id, unit_id, status, booking_id, party_id, assignee_id, service_id, order_item_id, metadata)
-      VALUES
-        (a.tenant_id, a.unit_id, 'contracted', p_booking, a.party_id, a.assignee_id,
-         v_item.product_id, v_item.id,
-         jsonb_build_object('source', 'clinical_contract_services'));
-      v_total := v_total + 1;
-    END LOOP;
-  END LOOP;
-
-  RETURN v_total;
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_sessions_for_order(uuid, uuid) TO authenticated;
-
-
-CREATE OR REPLACE FUNCTION public.clinical_contract_services(p_booking uuid, p_lines jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_order uuid; v_line jsonb; v_item uuid; v_n int := 0;
-  v_rpc_lines jsonb := '[]'::jsonb; v_idx int := 0;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-  IF jsonb_typeof(p_lines) <> 'array' OR jsonb_array_length(p_lines) = 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_marcado');
-  END IF;
-
-  -- As linhas, no formato que \`order_create\` j\xE1 entende.
-  FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-  LOOP
-    v_rpc_lines := v_rpc_lines || jsonb_build_object(
-      'product_id', v_line ->> 'service_id',
-      'name', v_line ->> 'name',
-      'quantity', coalesce((v_line ->> 'quantity')::numeric, 1),
-      'unit_price', coalesce((v_line ->> 'unit_price')::numeric, 0),
-      'sort_order', v_idx);
-    v_idx := v_idx + 1;
-  END LOOP;
-
-  -- O pedido do atendimento. \`idempotency_key\` pelo agendamento: dois toques
-  -- no "Contratar" n\xE3o abrem duas contas para a mesma visita.
-  IF a.order_id IS NULL THEN
-    v_order := public.order_create(
-      p_kind => 'appointment',
-      p_lines => v_rpc_lines,
-      p_party_id => a.party_id,
-      p_unit_id => a.unit_id,
-      p_status => 'scheduled',
-      p_assignee_id => a.assignee_id,
-      p_metadata => jsonb_build_object('agenda', jsonb_build_object('booking_id', p_booking), 'source', 'clinical:contratacao'),
-      p_idempotency_key => 'clinical-contract:' || p_booking::text);
-    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = p_booking;
-  ELSE
-    -- Pedido j\xE1 existe (a agenda abriu na marca\xE7\xE3o): acrescenta o que falta.
-    v_order := a.order_id;
-    v_idx := coalesce((SELECT max(i.sort_order) + 1 FROM public.items i WHERE i.order_id = v_order), 0);
-    FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines)
-    LOOP
-      INSERT INTO public.items (tenant_id, unit_id, order_id, product_id, name, quantity, unit_price, total, sort_order)
-      VALUES (a.tenant_id, a.unit_id, v_order, (v_line ->> 'service_id')::uuid, v_line ->> 'name',
-              coalesce((v_line ->> 'quantity')::numeric, 1),
-              coalesce((v_line ->> 'unit_price')::numeric, 0),
-              coalesce((v_line ->> 'quantity')::numeric, 1) * coalesce((v_line ->> 'unit_price')::numeric, 0),
-              v_idx);
-      v_idx := v_idx + 1;
-    END LOOP;
-  END IF;
-
-  -- Cada sess\xE3o passa a apontar a SUA linha. Sem isto o pedido cobra e o
-  -- atendimento n\xE3o sabe o que executou \u2014 e a bola "Conta do atendimento"
-  -- nunca fecha, porque \xE9 exatamente este v\xEDnculo que ela procura.
-  UPDATE public.plg_clinical_sessions cs
-     SET order_item_id = i.id,
-         status = CASE WHEN cs.status IN ('quoted', 'pending', 'scheduled') THEN 'contracted' ELSE cs.status END,
-         updated_at = now()
-    FROM public.items i
-   WHERE cs.booking_id = p_booking
-     AND cs.order_item_id IS NULL
-     AND i.order_id = v_order
-     AND i.product_id = cs.service_id
-     AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions o
-                      WHERE o.order_item_id = i.id AND o.id <> cs.id);
-  GET DIAGNOSTICS v_n = ROW_COUNT;
-
-  -- O que foi contratado e n\xE3o tinha sess\xE3o ganha a sua (018).
-  PERFORM public.clinical_sessions_for_order(p_booking, v_order);
-
-  RETURN jsonb_build_object(
-    'ok', true, 'order_id', v_order, 'sessoes_ligadas', v_n,
-    'total', (SELECT coalesce(sum(i.total), 0) FROM public.items i WHERE i.order_id = v_order),
-    'regua', public.clinical_requirements_refresh(p_booking));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_contract_services(uuid, jsonb) TO authenticated;
-`;
-var MIGRATION_019_ADIAR_E_UMA_ESCOLHA = `-- Adiar \xE9 uma escolha, e encerrar n\xE3o pode desfaz\xEA-la.
---
--- O "Executar neste atendimento" existe para dizer o que sai HOJE; o resto
--- fica contratado para outro dia. Mas o \`Finalizar\` marcava como executada
--- TODA sess\xE3o do agendamento \u2014 inclusive a que acabara de ser adiada. O
--- servi\xE7o sumia do "a executar" da conta e a cliente ficava com um
--- procedimento pago que ningu\xE9m fez, e que o sistema jurava ter feito.
---
--- O aviso de encerramento tinha o mesmo v\xEDcio: cobrava por servi\xE7os que a
--- pessoa tinha acabado de dizer que ficariam para depois.
---
--- Agora as duas coisas olham para \`in_service\` \u2014 o que entrou na sala. O que
--- est\xE1 em \`contracted\` \xE9 trabalho futuro e atravessa o encerramento intacto.
-
-CREATE OR REPLACE FUNCTION public.clinical_attendance_finish(p_booking uuid, p_force boolean DEFAULT false)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_bloqueia jsonb; v_nao_executados jsonb;
-  v_avisados int := 0; v_total numeric := 0; v_cliente text;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status, ap.order_id
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional'); END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.status <> 'in_progress' THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'atendimento_nao_esta_em_curso');
-  END IF;
-
-  -- A trava de verdade: exig\xEAncia que impede TERMINAR.
-  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', r.kind, 'service_id', r.service_id)), '[]'::jsonb)
-    INTO v_bloqueia
-    FROM public.plg_clinical_requirements r
-   WHERE r.booking_id = p_booking AND r.blocks_finish AND r.status = 'pending';
-  IF jsonb_array_length(v_bloqueia) > 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'exigencia_bloqueia', 'itens', v_bloqueia);
-  END IF;
-
-  -- O aviso que n\xE3o trava: o que ENTROU NA SALA e n\xE3o foi confirmado.
-  --
-  -- "Fica para outra data" \xE9 uma escolha, n\xE3o um esquecimento: sess\xE3o em
-  -- \`contracted\` \xE9 trabalho futuro, j\xE1 na conta, e n\xE3o tem por que ser
-  -- cobrada no aviso nem executada \xE0 for\xE7a ao encerrar.
-  SELECT coalesce(jsonb_agg(p.name ORDER BY p.name), '[]'::jsonb) INTO v_nao_executados
-    FROM public.plg_clinical_sessions cs
-    JOIN public.products p ON p.id = cs.service_id
-   WHERE cs.booking_id = p_booking AND cs.status = 'in_service';
-  IF jsonb_array_length(v_nao_executados) > 0 AND NOT coalesce(p_force, false) THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'servicos_nao_executados', 'itens', v_nao_executados);
-  END IF;
-
-  -- "Finalizar agora registra estes servi\xE7os como executados" \u2014 texto do V1,
-  -- e vale para os que estavam EM EXECU\xC7\xC3O. O que foi adiado continua
-  -- contratado: marc\xE1-lo executado sumiria com ele do "a executar" da conta
-  -- sem que a cliente tivesse recebido nada.
-  UPDATE public.plg_clinical_sessions
-     SET status = 'executed', ended_at = coalesce(ended_at, now()), updated_at = now()
-   WHERE booking_id = p_booking AND status = 'in_service';
-
-  UPDATE public.appointments
-     SET status = 'completed', updated_at = now()
-   WHERE id = p_booking;
-
-  -- Congela a trilha: depois de encerrado, a r\xE9gua n\xE3o se reapura.
-  PERFORM public.clinical_requirements_refresh(p_booking, true);
-
-  SELECT coalesce(sum(i.total), 0) INTO v_total FROM public.items i WHERE i.order_id = a.order_id;
-  SELECT pe.name INTO v_cliente FROM public.people pe WHERE pe.id = a.party_id;
-
-  -- O BALC\xC3O ACENDE.
-  --
-  -- Quem recebe: a recep\xE7\xE3o da conta. Onde n\xE3o houver ningu\xE9m com o papel de
-  -- recep\xE7\xE3o \u2014 e \xE9 o caso do tenant migrado, com 0 membros nele \u2014, cai para
-  -- gerente e dono. Um aviso que n\xE3o chega a ningu\xE9m deixaria a conta parada
-  -- sem que nada na tela dissesse por qu\xEA.
-  WITH alvo AS (
-    SELECT m.user_id
-      FROM app.memberships m
-      JOIN app.roles r ON r.id = m.role_id
-     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
-       AND r.key IN ('recepcao', 'reception')
-    UNION ALL
-    SELECT m.user_id
-      FROM app.memberships m
-      JOIN app.roles r ON r.id = m.role_id
-     WHERE m.tenant_id = a.tenant_id AND coalesce(m.active, true)
-       AND r.key IN ('owner', 'manager')
-       AND NOT EXISTS (
-         SELECT 1 FROM app.memberships m2 JOIN app.roles r2 ON r2.id = m2.role_id
-          WHERE m2.tenant_id = a.tenant_id AND coalesce(m2.active, true)
-            AND r2.key IN ('recepcao', 'reception'))
-  )
-  INSERT INTO public.notifications (tenant_id, user_id, title, body, type, link, subject_type, subject_id)
-  SELECT a.tenant_id, alvo.user_id,
-         'Checkout pendente',
-         coalesce(v_cliente, 'Cliente') || ' terminou o atendimento'
-           -- O dinheiro escrito como o Brasil escreve. \`to_char\` usa o
-           -- \`lc_numeric\` do BANCO para o grupo e a v\xEDrgula, e o cluster est\xE1
-           -- em C: sa\xEDa "R$ 999.00" no aviso de uma recep\xE7\xE3o brasileira. A
-           -- troca \xE9 feita \xE0 m\xE3o para n\xE3o depender de locale nenhum.
-           || CASE WHEN v_total > 0 THEN ' \xB7 R$ ' ||
-                replace(replace(replace(to_char(v_total, 'FM999G999G999D00'), ',', '\xA7'), '.', ','), '\xA7', '.')
-              ELSE '' END,
-         'checkout_pendente', '#/checkin', 'appointment', p_booking
-    FROM alvo
-  ON CONFLICT (user_id, subject_type, subject_id, type) WHERE subject_id IS NOT NULL DO NOTHING;
-  GET DIAGNOSTICS v_avisados = ROW_COUNT;
-
-  RETURN jsonb_build_object(
-    'ok', true, 'avisados', v_avisados, 'total', v_total,
-    'executados', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking AND status = 'executed'));
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_attendance_finish(uuid, boolean) TO authenticated;
-`;
-var MIGRATION_020_COBRAR_UM_AGENDAMENTO_SEM_PEDIDO_LEVANTA_O_PEDIDO = `-- ============================================================================
--- Cobrar um agendamento SEM pedido levanta o pedido primeiro
---
--- SINTOMA, visto na tela (23-09, Juliane): a aba Financeiro acende o vermelho
--- do V1 ("atendimento de hoje sem cobran\xE7a levantada"), mas a conta n\xE3o
--- oferece caminho nenhum \u2014 o agendamento veio da MIGRA\xC7\xC3O do V1 com
--- \`order_id\` nulo, e a linha do servi\xE7o mora em \`appointment_items\`, n\xE3o em
--- \`items\`. O V1 nunca teve esse beco: "Gerar Recebimento" l\xE1 CRIA a fatura a
--- partir dos servi\xE7os do agendamento.
---
--- A tradu\xE7\xE3o para o V2 respeita o caminho \xFAnico do dinheiro: a cobran\xE7a n\xE3o
--- escreve fatura \u2014 ela LEVANTA O PEDIDO pela porta do n\xFAcleo (\`order_create\`,
--- a mesma que \`agenda_booking_create\` usa) com as linhas COM PRE\xC7O dos
--- \`appointment_items\`, amarra o pedido ao agendamento e segue o fechamento
--- normal (\`orders_raise_receivable_on_close\`).
---
--- Linha sem pre\xE7o n\xE3o vira pedido: revis\xE3o e avalia\xE7\xE3o gratuitas continuam
--- sem cobran\xE7a, e a recusa \`nada_contratado\` continua falando por elas.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_checkout_charge(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_linhas int; v_total numeric; v_mov int; v_lines jsonb; v_order uuid;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.kind, ap.status, ap.order_id,
-         ap.party_id, ap.assignee_id, ap.unit_id
-    INTO a
-    FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-  IF auth.uid() IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'sem_sessao'); END IF;
-  -- O agendamento de OUTRA conta n\xE3o existe para esta sess\xE3o.
-  IF a.tenant_id IS DISTINCT FROM app.current_tenant_id() THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
-  END IF;
-
-  IF a.order_id IS NULL THEN
-    -- As linhas com pre\xE7o do agendamento migrado. Sem nenhuma, n\xE3o h\xE1 o que
-    -- cobrar \u2014 e isso \xE9 um estado leg\xEDtimo (revis\xE3o, avalia\xE7\xE3o gratuita).
-    SELECT jsonb_agg(jsonb_build_object(
-             'service_id', ai.service_id,
-             'name', ai.name,
-             'quantity', 1,
-             'unit_price', ai.price,
-             'sort_order', ai.sort_order,
-             'duration_minutes', ai.duration_minutes,
-             'assignee_id', coalesce(ai.assignee_id, a.assignee_id)
-           ) ORDER BY ai.sort_order)
-      INTO v_lines
-      FROM public.appointment_items ai
-     WHERE ai.booking_id = a.id AND coalesce(ai.price, 0) > 0;
-
-    IF v_lines IS NULL THEN
-      RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
-    END IF;
-
-    v_order := public.order_create(
-      p_kind        => coalesce(a.kind, 'appointment'),
-      p_lines       => v_lines,
-      p_party_id    => a.party_id,
-      p_unit_id     => a.unit_id,
-      p_status      => 'scheduled',
-      p_assignee_id => a.assignee_id,
-      p_metadata    => jsonb_build_object('source', 'clinical_checkout_charge', 'booking_id', a.id));
-
-    UPDATE public.appointments SET order_id = v_order, updated_at = now() WHERE id = a.id;
-    a.order_id := v_order;
-  END IF;
-
-  SELECT count(*), coalesce(sum(i.total), 0) INTO v_linhas, v_total
-    FROM public.items i WHERE i.order_id = a.order_id;
-  IF v_linhas = 0 THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nada_contratado');
-  END IF;
-
-  -- Idempotente: o pedido j\xE1 fechado devolve o que existe, sem levantar um
-  -- segundo receb\xEDvel para a mesma visita.
-  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
-  IF v_mov > 0 THEN
-    RETURN jsonb_build_object('ok', true, 'ja_cobrado', true, 'total', v_total);
-  END IF;
-
-  UPDATE public.orders SET status = 'completed', updated_at = now()
-   WHERE id = a.order_id AND status <> 'completed';
-
-  SELECT count(*) INTO v_mov FROM public.plg_financial_movements m WHERE m.invoice_id = a.order_id;
-  RETURN jsonb_build_object('ok', true, 'total', v_total, 'movimentos', v_mov);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_checkout_charge(uuid) TO authenticated;
-`;
-var MIGRATION_021_AGENDAMENTO_NASCIDO_NO_V2_TAMBEM_TEM_REGUA = `-- ============================================================================
--- O AGENDAMENTO NASCIDO NO V2 TAMB\xC9M TEM R\xC9GUA
---
--- O Iniciar atendimento percorre \`appointment_items\` \u2014 a linha do agendamento
--- do V1, onde as 314 mil linhas migradas moram. S\xF3 que o Novo Agendamento do
--- V2 grava as linhas pelo caminho do PEDIDO (\`agenda_booking_create\` \u2192
--- \`orders\` + \`items\`), e nunca escreve \`appointment_items\`. Resultado, visto
--- na tela em 23/09: o bot\xE3o vira "Em atendimento", e a r\xE9gua nasce VAZIA \u2014
--- zero sess\xF5es, zero exig\xEAncias, bolas nenhuma. Todo agendamento criado pela
--- pr\xF3pria UI do V2 ca\xEDa nisso; s\xF3 os migrados do V1 funcionavam.
---
--- O conserto MATERIALIZA a linha do agendamento na hora de come\xE7ar: se o
--- agendamento tem pedido e ainda n\xE3o tem \`appointment_items\`, elas nascem das
--- linhas do pedido \u2014 e o resto do fluxo (sess\xF5es, FK de \`booking_item_id\`,
--- r\xE9gua, produtos por servi\xE7o) continua lendo o modelo que sempre leu.
--- Idempotente: s\xF3 insere quando n\xE3o h\xE1 linha nenhuma para o agendamento.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.clinical_attendance_start(p_booking uuid)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO 'public', 'app'
-AS $fn$
-DECLARE
-  a record; v_person uuid; v_created int := 0; v_adotadas int := 0;
-  v_item record; v_refresh jsonb; v_antiga uuid;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.unit_id, ap.party_id, ap.assignee_id, ap.status,
-         ap.starts_at, ap.order_id
-    INTO a FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'not_found');
-  END IF;
-
-  v_person := public.current_person_id();
-  IF v_person IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'sem_ficha_de_profissional');
-  END IF;
-  IF a.assignee_id IS DISTINCT FROM v_person THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_seu_atendimento');
-  END IF;
-  IF a.starts_at::date <> (now() AT TIME ZONE 'America/Sao_Paulo')::date THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'nao_e_de_hoje');
-  END IF;
-  IF a.status IN ('completed', 'cancelled', 'no_show') THEN
-    RETURN jsonb_build_object('ok', false, 'reason', 'ja_encerrado', 'status', a.status);
-  END IF;
-
-  -- Agendamento nascido no V2: as linhas vivem no pedido. Materializa a linha
-  -- do agendamento \u2014 uma vez s\xF3 \u2014 para o resto do fluxo ter onde se pendurar.
-  IF a.order_id IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM public.appointment_items ai WHERE ai.booking_id = a.id) THEN
-    INSERT INTO public.appointment_items (
-      tenant_id, unit_id, booking_id, service_id, name, price,
-      duration_minutes, assignee_id, sort_order)
-    -- \`coalesce(product_id, service_id)\`: o \`order_create\` grava o servi\xE7o em
-    -- \`service_id\`; a edi\xE7\xE3o pela agenda grava em \`product_id\` (spine 190).
-    -- As duas gera\xE7\xF5es de linha existem no banco.
-    SELECT a.tenant_id, a.unit_id, a.id, coalesce(it.product_id, it.service_id),
-           it.name, it.unit_price,
-           it.duration_minutes, coalesce(it.assignee_id, a.assignee_id),
-           coalesce(it.sort_order, 0)
-      FROM public.items it
-     WHERE it.order_id = a.order_id;
-  END IF;
-
-  FOR v_item IN
-    SELECT ai.id, ai.service_id, ai.assignee_id
-      FROM public.appointment_items ai
-     WHERE ai.booking_id = p_booking
-  LOOP
-    -- J\xE1 existe sess\xE3o para este item? (dois toques, duas pessoas ao mesmo tempo)
-    CONTINUE WHEN EXISTS (
-      SELECT 1 FROM public.plg_clinical_sessions cs
-       WHERE cs.booking_id = p_booking AND cs.booking_item_id = v_item.id);
-
-    -- O QUE FOI COMPRADO ANTES E AINDA N\xC3O SAIU: adota em vez de criar.
-    SELECT cs.id INTO v_antiga
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.tenant_id = a.tenant_id
-       AND cs.party_id = a.party_id
-       AND cs.service_id = v_item.service_id
-       AND cs.booking_id IS NULL
-       AND cs.status IN ('contracted', 'quoted', 'pending')
-     ORDER BY cs.created_at
-     LIMIT 1;
-
-    IF v_antiga IS NOT NULL THEN
-      UPDATE public.plg_clinical_sessions
-         SET booking_id = p_booking,
-             booking_item_id = v_item.id,
-             unit_id = coalesce(a.unit_id, unit_id),
-             assignee_id = coalesce(v_item.assignee_id, a.assignee_id),
-             performed_by_id = v_person,
-             status = 'in_service',
-             scheduled_for = a.starts_at,
-             started_at = coalesce(started_at, now()),
-             updated_at = now()
-       WHERE id = v_antiga;
-      v_adotadas := v_adotadas + 1;
-    ELSE
-      INSERT INTO public.plg_clinical_sessions (
-        tenant_id, unit_id, status, booking_id, booking_item_id, party_id,
-        assignee_id, performed_by_id, service_id, scheduled_for, started_at)
-      VALUES (a.tenant_id, a.unit_id, 'in_service', a.id, v_item.id, a.party_id,
-              coalesce(v_item.assignee_id, a.assignee_id), v_person, v_item.service_id,
-              a.starts_at, now());
-      v_created := v_created + 1;
-    END IF;
-  END LOOP;
-
-  UPDATE public.appointments
-     SET status = 'in_progress', updated_at = now()
-   WHERE id = p_booking AND status <> 'in_progress';
-
-  v_refresh := public.clinical_requirements_refresh(p_booking);
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'sessoes_criadas', v_created,
-    'sessoes_adotadas', v_adotadas,
-    'sessoes', (SELECT count(*) FROM public.plg_clinical_sessions WHERE booking_id = p_booking),
-    'regua', v_refresh);
-END $fn$;
-
-GRANT EXECUTE ON FUNCTION public.clinical_attendance_start(uuid) TO authenticated;
-`;
-var MIGRATION_022_A_VISTA_DO_QUE_EXECUTAR_RESPEITA_A_CERCA = `-- ============================================================================
--- THE "TO EXECUTE" VIEW READS WITH THE CALLER'S PRIVILEGES
---
--- \`v_clinical_to_execute\` was created in 014 without \`security_invoker\`, so it
--- ran with the privileges of the role that OWNS it, and a view owned by a
--- privileged role does not apply the row policies of the tables beneath it.
--- \`plg_clinical_sessions\`, \`items\` and \`plg_financial_movements\` are all
--- tenant-scoped with RLS; read through this view, they were not.
---
--- Not theoretical: the view answers, per party, how much a patient has already
--- PAID for procedures not yet performed. Without the fence that is every
--- clinic's prepaid balance, to anyone holding any session.
---
--- \u2500\u2500 why nobody saw it \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- N16 of the posture suite grades exactly this ("every public view over a
--- tenant_id table is security_invoker"), and it stayed green throughout:
--- plugin-clinical was never listed in \`packages/db/chain.json\`, so its objects
--- were never built on the bench and never graded. The plugin reached a live
--- pool on 2026-09-22 and no board at all. Putting it in the chain is what made
--- the suite fail, on the first run, in the expected place.
---
--- \u2500\u2500 why a new file, and not an edit to 014 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
---
--- 014 is in \`public._migrations\` on a live pool with checksum 6f04df24cdb2,
--- and the ledger treats a changed checksum on an applied file as a HARD STOP
--- (cli/src/lib/ledger.ts). Editing it in place would not fix the view \u2014 it
--- would stop \`fayz db apply\` on every cluster that already ran it.
---
--- The body below is 014's, copied unchanged. \`CREATE OR REPLACE VIEW\` refuses
--- a different column list, and the only thing that may differ here is who the
--- row filter runs as.
--- ============================================================================
-
-CREATE OR REPLACE VIEW public.v_clinical_to_execute WITH (security_invoker = true) AS
-WITH sessao AS (
-  SELECT
-    cs.tenant_id,
-    cs.party_id,
-    cs.order_item_id,
-    cs.status,
-    i.order_id,
-    coalesce(i.total, 0) AS item_total
-  FROM public.plg_clinical_sessions cs
-  JOIN public.items i ON i.id = cs.order_item_id
-  WHERE cs.party_id IS NOT NULL
-    AND cs.status IN ('contracted', 'quoted', 'in_service', 'scheduled', 'pending')
-),
--- Quanto do PEDIDO j\xE1 foi recebido, em propor\xE7\xE3o: o pagamento \xE9 por parcela e
--- n\xE3o por item, ent\xE3o a fatia paga de cada item \xE9 a fatia paga do pedido.
-pago AS (
-  SELECT m.invoice_id AS order_id,
-         sum(coalesce(m.paid_amount, 0)) AS pago,
-         nullif(sum(coalesce(m.amount, 0)), 0) AS total
-    FROM public.plg_financial_movements m
-   WHERE m.direction = 'credit'
-   GROUP BY m.invoice_id
-)
-SELECT
-  s.tenant_id,
-  s.party_id,
-  sum(s.item_total * coalesce(p.pago / p.total, 0))::numeric(14,2) AS paid_to_execute,
-  sum(s.item_total * (1 - coalesce(p.pago / p.total, 0)))::numeric(14,2) AS open_to_execute,
-  count(*)::int AS sessions_to_execute
-FROM sessao s
-LEFT JOIN pago p ON p.order_id = s.order_id
-GROUP BY s.tenant_id, s.party_id;
-`;
-var MIGRATION_023_A_REVISAO_SE_ESCOLHE_AO_AGENDAR = `-- ============================================================================
--- 023 \u2014 The revision is chosen when it is booked, not only during the visit.
--- ============================================================================
--- V1 asks "De qual servi\xE7o \xE9 esta revis\xE3o?" the moment the reception picks the
--- Revis\xE3o service in Novo Agendamento (FAY-1613). 015 answered it only from an
--- existing booking. This lists the same candidates for a PERSON, with the ordinal
--- the next revision of each will take (V1 shows "1\xAA Revis\xE3o").
---
--- Also closes a gap in 015: \`clinical_revision_candidates(p_booking)\` is a
--- definer function that read any booking id it was given, so a member of one
--- tenant could list another tenant's patient history by guessing an id. Both
--- now answer only inside the caller's tenant.
---
--- Idempotent.
-
-CREATE OR REPLACE FUNCTION public.clinical_revision_candidates_for_person(p_person uuid)
-RETURNS TABLE(session_id uuid, service_id uuid, service_name text, executed_on timestamp with time zone,
-              deadline_days integer, days_since integer, within_deadline boolean, next_revision_number integer)
-LANGUAGE sql
-STABLE SECURITY DEFINER
-SET search_path TO 'public', 'app'
-AS $function$
-  SELECT
-    cs.id,
-    cs.service_id,
-    p.name,
-    coalesce(cs.ended_at, cs.scheduled_for) AS executed_on,
-    rev.deadline_days,
-    (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date)::int AS days_since,
-    CASE WHEN rev.deadline_days IS NULL THEN NULL
-         ELSE (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date) <= rev.deadline_days
-    END AS within_deadline,
-    coalesce((SELECT max(r.revision_number) FROM public.plg_clinical_sessions r
-               WHERE r.tenant_id = cs.tenant_id AND r.parent_session_id = cs.id), 0) + 1
-  FROM public.plg_clinical_sessions cs
-  LEFT JOIN public.products p ON p.id = cs.service_id
-  LEFT JOIN LATERAL (
-    SELECT r.deadline_days FROM public.plg_clinical_service_revisions r
-     WHERE r.tenant_id = cs.tenant_id AND r.service_id = cs.service_id
-     ORDER BY r.revision_number LIMIT 1
-  ) rev ON true
-  WHERE cs.tenant_id = app.current_tenant_id()
-    AND cs.party_id = p_person
-    AND cs.status = 'executed'
-    AND cs.parent_session_id IS NULL
-  ORDER BY coalesce(cs.ended_at, cs.scheduled_for) DESC NULLS LAST
-  LIMIT 50;
-$function$;
-
-REVOKE ALL ON FUNCTION public.clinical_revision_candidates_for_person(uuid) FROM PUBLIC, anon;
-GRANT EXECUTE ON FUNCTION public.clinical_revision_candidates_for_person(uuid) TO authenticated;
-
-CREATE OR REPLACE FUNCTION public.clinical_revision_candidates(p_booking uuid)
-RETURNS TABLE(session_id uuid, service_id uuid, service_name text, executed_on timestamp with time zone,
-              deadline_days integer, days_since integer, within_deadline boolean)
-LANGUAGE sql
-STABLE SECURITY DEFINER
-SET search_path TO 'public', 'app'
-AS $function$
-  WITH alvo AS (
-    SELECT ap.tenant_id, ap.party_id FROM public.appointments ap
-     WHERE ap.id = p_booking AND ap.tenant_id = app.current_tenant_id()
-  )
-  SELECT
-    cs.id,
-    cs.service_id,
-    p.name,
-    coalesce(cs.ended_at, cs.scheduled_for) AS executed_on,
-    rev.deadline_days,
-    (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date)::int AS days_since,
-    CASE WHEN rev.deadline_days IS NULL THEN NULL
-         ELSE (current_date - coalesce(cs.ended_at, cs.scheduled_for)::date) <= rev.deadline_days
-    END AS within_deadline
-  FROM public.plg_clinical_sessions cs
-  JOIN alvo a ON a.tenant_id = cs.tenant_id AND a.party_id = cs.party_id
-  LEFT JOIN public.products p ON p.id = cs.service_id
-  LEFT JOIN LATERAL (
-    SELECT r.deadline_days FROM public.plg_clinical_service_revisions r
-     WHERE r.tenant_id = cs.tenant_id AND r.service_id = cs.service_id
-     ORDER BY r.revision_number LIMIT 1
-  ) rev ON true
-  WHERE cs.status = 'executed'
-    AND cs.booking_id IS DISTINCT FROM p_booking
-  ORDER BY coalesce(cs.ended_at, cs.scheduled_for) DESC NULLS LAST
-  LIMIT 50;
-$function$;
-`;
-var MIGRATION_024_A_AVALIACAO_DESTA_VISITA_VALE_PARA_O_QUE_ELA_CONTRATOU = `-- The evaluation done in this attendance covers what was contracted in it.
---
--- FAY-1613 (Espa\xE7o Facial, etapa 3): the professional fills the "Avalia\xE7\xE3o" form, indicates, the
--- client contracts \u2014 and every contracted session came out with its own "Avalia\xE7\xE3o" step pending,
--- because nothing in V2 points a contracted session at the evaluation that authorised it
--- (\`source_evaluation_id\` is only set by the V1 import). V1 shows "Avalia\xE7\xE3o conclu\xEDda \u2014 o
--- atendimento segue para a execu\xE7\xE3o" at that point.
---
--- Same body as live, plus step 5c. Idempotent (CREATE OR REPLACE).
-
-CREATE OR REPLACE FUNCTION public.clinical_requirements_refresh(p_booking uuid, p_final boolean DEFAULT false)
- RETURNS jsonb
- LANGUAGE plpgsql
- SECURITY DEFINER
- SET search_path TO 'public'
-AS $function$
-DECLARE
-  a record; v_mode text; v_now timestamptz := now(); v_eval jsonb;
-  n_mat int := 0; n_reopen int := 0;
-  -- \`v_sessao\`, n\xE3o \`r\`: plpgsql resolve o nome da VARI\xC1VEL antes do apelido da
-  -- tabela, ent\xE3o um \`record r\` declarado aqui sequestra todo \`r.coluna\` dos
-  -- UPDATEs abaixo \u2014 e o erro que sai \xE9 "record r has no field booking_id".
-  v_sessao record;
-BEGIN
-  SELECT ap.id, ap.tenant_id, ap.party_id, ap.status INTO a
-    FROM public.appointments ap WHERE ap.id = p_booking;
-  IF NOT FOUND THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
-
-  v_mode := public.clinical_requirements_mode(a.tenant_id);
-  IF v_mode = 'off' THEN RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'skipped', true); END IF;
-
-  p_final := coalesce(p_final, false) AND a.status = 'completed';
-
-  BEGIN
-    PERFORM pg_advisory_xact_lock(hashtextextended('clinical_req:' || p_booking::text, 0));
-    IF a.status = 'completed' AND NOT p_final THEN
-      RETURN jsonb_build_object('ok', true, 'mode', v_mode, 'frozen', true);
-    END IF;
-
-    -- 1) Materializa o que falta (sess\xE3o nova, ficha t\xE9cnica criada depois).
-    FOR v_sessao IN SELECT cs.id FROM public.plg_clinical_sessions cs WHERE cs.booking_id = p_booking
-    LOOP
-      n_mat := n_mat + public.clinical_requirements_materialize(v_sessao.id);
-    END LOOP;
-
-    v_eval := coalesce((SELECT t.settings -> 'evaluation_flow' FROM public.tenants t WHERE t.id = a.tenant_id), '{}'::jsonb);
-    IF jsonb_typeof(v_eval) <> 'object' THEN v_eval := '{}'::jsonb; END IF;
-
-    -- 1b) Regra que saiu da configura\xE7\xE3o para de bloquear (o upsert reabre se voltar).
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'not_applicable', candidate_type = NULL, candidate_id = NULL, updated_at = v_now
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.frozen_at IS NULL
-       AND r.metadata -> 'migration' IS NULL
-       AND ((r.kind = 'revision_link' AND NOT coalesce((v_eval ->> 'revision_link_required')::boolean, false))
-         OR (r.kind = 'evaluation'
-             AND r.rule_sources = '["evaluation_flow.require_evaluation_for_kind_service"]'::jsonb
-             AND NOT coalesce((v_eval ->> 'require_evaluation_for_kind_service')::boolean, false)));
-
-    -- 2) Reabre o que perdeu a fonte. Linha congelada n\xE3o se mexe.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'pending', subject_type = NULL, subject_id = NULL, resolved_via = NULL,
-           resolved_at = NULL, valid_until = NULL, updated_at = v_now
-     WHERE r.booking_id = p_booking AND r.status = 'resolved' AND r.frozen_at IS NULL
-       AND ((r.subject_type = 'documents' AND NOT EXISTS (SELECT 1 FROM public.documents d WHERE d.id = r.subject_id))
-         OR (r.subject_type = 'clinical_sessions' AND NOT EXISTS (SELECT 1 FROM public.plg_clinical_sessions x WHERE x.id = r.subject_id))
-         OR (r.subject_type = 'items' AND NOT EXISTS (SELECT 1 FROM public.items oi WHERE oi.id = r.subject_id)));
-    GET DIAGNOSTICS n_reopen = ROW_COUNT;
-
-    -- 3) Formul\xE1rio universal: a \xFAltima resposta do cliente, em qualquer
-    --    atendimento, ainda dentro da validade do modelo.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
-           resolved_via = CASE WHEN x.subject_id = p_booking THEN 'attendance' ELSE 'auto_client' END,
-           resolved_at = v_now,
-           valid_until = CASE WHEN x.validity_days IS NULL THEN NULL
-                              ELSE x.eff + make_interval(days => x.validity_days) END,
-           updated_at = v_now
-      FROM (SELECT DISTINCT ON (fd.template_id) d.id, fd.template_id, d.subject_id,
-                   coalesce(d.updated_at, d.created_at) AS eff, ft.validity_days
-              FROM public.plg_forms_documents fd
-              JOIN public.documents d ON d.id = fd.document_id
-              JOIN public.plg_forms_templates ft ON ft.id = fd.template_id
-             WHERE d.person_id = a.party_id AND d.tenant_id = a.tenant_id
-             ORDER BY fd.template_id, coalesce(d.updated_at, d.created_at) DESC) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
-       AND r.scope = 'attendance' AND r.ref_id = x.template_id
-       AND r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb
-       AND (x.validity_days IS NULL OR x.eff + make_interval(days => x.validity_days) > v_now);
-
-    -- 4) Demais formul\xE1rios: qualquer resposta DESTE atendimento com o modelo.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'documents', subject_id = x.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM (SELECT DISTINCT ON (fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid))
-                   d.id, fd.template_id, fd.product_id
-              FROM public.plg_forms_documents fd
-              JOIN public.documents d ON d.id = fd.document_id
-             WHERE d.subject_type = 'appointment' AND d.subject_id = p_booking
-             ORDER BY fd.template_id, coalesce(fd.product_id, '00000000-0000-0000-0000-000000000000'::uuid),
-                      coalesce(d.updated_at, d.created_at) DESC) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'form'
-       AND r.ref_id = x.template_id
-       AND NOT (r.rule_sources @> '["forms_templates.required_on_attendance"]'::jsonb)
-       AND (x.product_id IS NULL OR r.scope = 'attendance' OR x.product_id = r.service_id);
-
-    -- 5) Avalia\xE7\xE3o vinculada: a sess\xE3o aponta a avalia\xE7\xE3o que a autorizou.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = x.eval_id,
-           resolved_via = CASE WHEN x.same_booking THEN 'attendance' ELSE 'auto_client' END,
-           resolved_at = v_now, updated_at = v_now
-      FROM (SELECT r2.id AS req_id, e.id AS eval_id, (e.booking_id = p_booking) AS same_booking
-              FROM public.plg_clinical_requirements r2
-              JOIN public.plg_clinical_sessions cs ON cs.id = r2.session_id
-              JOIN public.plg_clinical_sessions e ON e.id = cs.source_evaluation_id
-             WHERE r2.booking_id = p_booking AND r2.kind = 'evaluation' AND r2.frozen_at IS NULL
-               AND (r2.status = 'pending' OR (r2.status = 'resolved' AND r2.resolved_via = 'legacy_grace'))) x
-     WHERE r.id = x.req_id;
-
-    -- 5b) Gra\xE7a legada: o cliente j\xE1 tem atendimento conclu\xEDdo com servi\xE7o de
-    --     avalia\xE7\xE3o. \xC9 a mesma concess\xE3o do V1, e vai marcada como tal.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'appointments', subject_id = x.booking_id,
-           resolved_via = 'legacy_grace', resolved_at = v_now, updated_at = v_now
-      FROM (SELECT ap.id AS booking_id
-              FROM public.appointments ap
-              JOIN public.appointment_items ai ON ai.booking_id = ap.id
-              JOIN public.products p ON p.id = ai.service_id AND p.service_kind = 'evaluation'
-             WHERE ap.party_id = a.party_id AND ap.tenant_id = a.tenant_id AND ap.status = 'completed'
-             ORDER BY ap.starts_at DESC NULLS LAST LIMIT 1) x
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'evaluation';
-
-    -- 5c) Avalia\xE7\xE3o feita NESTE atendimento. Contratar depois de avaliar cria sess\xF5es novas, e cada
-    --     uma nascia com a pr\xF3pria bola "Avalia\xE7\xE3o" pendente \u2014 o profissional acabou de avaliar.
-    --     Indica\xE7\xE3o registrada aqui (o formul\xE1rio de avalia\xE7\xE3o) ou sess\xE3o de avalia\xE7\xE3o deste
-    --     atendimento resolvem as sess\xF5es contratadas na mesma visita.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'appointments', subject_id = p_booking,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-     WHERE r.booking_id = p_booking AND r.status = 'pending' AND r.kind = 'evaluation'
-       AND r.frozen_at IS NULL
-       AND (EXISTS (SELECT 1 FROM public.plg_crm_deal_interest_appointments x WHERE x.appointment_id = p_booking)
-         OR EXISTS (SELECT 1 FROM public.plg_clinical_sessions e
-                      JOIN public.products p ON p.id = e.service_id AND p.service_kind = 'evaluation'
-                     WHERE e.booking_id = p_booking));
-
-    -- 6) Revis\xE3o vinculada ao servi\xE7o original.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.parent_session_id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'revision_link'
-       AND cs.parent_session_id IS NOT NULL
-       AND EXISTS (SELECT 1 FROM public.plg_clinical_sessions p WHERE p.id = cs.parent_session_id);
-
-    -- 7) Produtos: a sess\xE3o declara que foram conferidos.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'clinical_sessions', subject_id = cs.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'products'
-       AND coalesce(cs.products_initialized, false);
-
-    -- 8) Item de pedido vinculado. A linha do pedido no V2 \xE9 \`public.items\` \u2014
-    --    n\xE3o existe \`order_items\`; o pedido \xE9 o documento e o item \xE9 dele.
-    UPDATE public.plg_clinical_requirements r
-       SET status = 'resolved', subject_type = 'items', subject_id = oi.id,
-           resolved_via = 'attendance', resolved_at = v_now, updated_at = v_now
-      FROM public.plg_clinical_sessions cs
-      JOIN public.items oi ON oi.id = cs.order_item_id
-     WHERE cs.id = r.session_id AND r.booking_id = p_booking
-       AND r.status = 'pending' AND r.kind = 'invoice_item';
-
-    -- 9) Congelamento: s\xF3 na \xFAltima passada, com o atendimento conclu\xEDdo.
-    IF p_final THEN
-      UPDATE public.plg_clinical_requirements
-         SET frozen_at = coalesce(frozen_at, v_now), updated_at = v_now
-       WHERE booking_id = p_booking;
-    END IF;
-
-    RETURN jsonb_build_object(
-      'ok', true, 'mode', v_mode, 'materialized', n_mat, 'reopened', n_reopen,
-      'pending', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'pending'),
-      'resolved', (SELECT count(*) FROM public.plg_clinical_requirements WHERE booking_id = p_booking AND status = 'resolved'),
-      'frozen', p_final);
-  EXCEPTION WHEN others THEN
-    RAISE WARNING 'clinical_requirements_refresh(%): %', p_booking, sqlerrm;
-    RETURN jsonb_build_object('ok', false, 'error', sqlerrm);
-  END;
-END $function$;
-`;
-var MIGRATION_025_AS_REGRAS_DO_ATENDIMENTO_SAO_CONFIGURACAO = `-- The attendance rules 004 already reads, registered as setting keys so the
--- settings screen can write them through tenant_setting_set (typed, permission
--- checked). Same paths the V1 import wrote: tenants.settings.execution_requirements.mode
--- and tenants.settings.evaluation_flow.*. Nested writes keep the sibling keys.
---
--- Idempotent.
-SELECT app.seed_setting_keys($$[
-  { "key": "execution_requirements.mode", "type": "string", "default": "off", "scope": "tenant", "reader": "plugin:clinical",
-    "description": "Execution requirements: off, shadow (warn only) or on (block). V1: general_settings.execution_requirements.mode." },
-  { "key": "evaluation_flow.require_evaluation_for_kind_service", "type": "boolean", "default": false, "scope": "tenant", "reader": "plugin:clinical",
-    "description": "A paid service needs a linked evaluation. V1: general_settings.evaluation_flow." },
-  { "key": "evaluation_flow.revision_link_required", "type": "boolean", "default": false, "scope": "tenant", "reader": "plugin:clinical",
-    "description": "A revision must be linked to the original service; blocks start and finish. V1: general_settings.evaluation_flow." }
-]$$::jsonb);
-`;
-var MIGRATIONS = [
-  { id: "001_o_atendimento_clinico_tem_onde_morar", sql: MIGRATION_001_O_ATENDIMENTO_CLINICO_TEM_ONDE_MORAR },
-  { id: "002_o_prontuario_do_v1_atravessa", sql: MIGRATION_002_O_PRONTUARIO_DO_V1_ATRAVESSA },
-  { id: "003_a_permissao_se_pergunta_por_unidade_nao_por_linha", sql: MIGRATION_003_A_PERMISSAO_SE_PERGUNTA_POR_UNIDADE_NAO_POR_LINHA },
-  { id: "004_a_regua_volta_a_ser_apurada", sql: MIGRATION_004_A_REGUA_VOLTA_A_SER_APURADA },
-  { id: "005_comecar_o_atendimento_e_um_gesto_so", sql: MIGRATION_005_COMECAR_O_ATENDIMENTO_E_UM_GESTO_SO },
-  { id: "006_contratar_nao_e_pagar", sql: MIGRATION_006_CONTRATAR_NAO_E_PAGAR },
-  { id: "007_finalizar_acende_o_balcao", sql: MIGRATION_007_FINALIZAR_ACENDE_O_BALCAO },
-  { id: "008_conferir_nao_e_receber", sql: MIGRATION_008_CONFERIR_NAO_E_RECEBER },
-  { id: "009_o_botao_de_cobrar_cobra", sql: MIGRATION_009_O_BOTAO_DE_COBRAR_COBRA },
-  { id: "010_a_indicacao_vai_para_o_funil", sql: MIGRATION_010_A_INDICACAO_VAI_PARA_O_FUNIL },
-  { id: "011_interesse_e_indicacao_na_mesma_linha", sql: MIGRATION_011_INTERESSE_E_INDICACAO_NA_MESMA_LINHA },
-  { id: "012_o_que_foi_usado_espera_aprovacao", sql: MIGRATION_012_O_QUE_FOI_USADO_ESPERA_APROVACAO },
-  { id: "013_o_que_couber_hoje", sql: MIGRATION_013_O_QUE_COUBER_HOJE },
-  { id: "014_o_pago_a_executar_deixa_de_ser_invisivel", sql: MIGRATION_014_O_PAGO_A_EXECUTAR_DEIXA_DE_SER_INVISIVEL },
-  { id: "015_a_revisao_aponta_o_que_revisa", sql: MIGRATION_015_A_REVISAO_APONTA_O_QUE_REVISA },
-  { id: "016_a_compra_antecipada_nao_tem_agendamento_atras", sql: MIGRATION_016_A_COMPRA_ANTECIPADA_NAO_TEM_AGENDAMENTO_ATRAS },
-  { id: "017_o_que_ja_foi_pago_nao_se_cobra_de_novo", sql: MIGRATION_017_O_QUE_JA_FOI_PAGO_NAO_SE_COBRA_DE_NOVO },
-  { id: "018_o_que_foi_contratado_vira_sessao", sql: MIGRATION_018_O_QUE_FOI_CONTRATADO_VIRA_SESSAO },
-  { id: "019_adiar_e_uma_escolha", sql: MIGRATION_019_ADIAR_E_UMA_ESCOLHA },
-  { id: "020_cobrar_um_agendamento_sem_pedido_levanta_o_pedido", sql: MIGRATION_020_COBRAR_UM_AGENDAMENTO_SEM_PEDIDO_LEVANTA_O_PEDIDO },
-  { id: "021_agendamento_nascido_no_v2_tambem_tem_regua", sql: MIGRATION_021_AGENDAMENTO_NASCIDO_NO_V2_TAMBEM_TEM_REGUA },
-  { id: "022_a_vista_do_que_executar_respeita_a_cerca", sql: MIGRATION_022_A_VISTA_DO_QUE_EXECUTAR_RESPEITA_A_CERCA },
-  { id: "023_a_revisao_se_escolhe_ao_agendar", sql: MIGRATION_023_A_REVISAO_SE_ESCOLHE_AO_AGENDAR },
-  { id: "024_a_avaliacao_desta_visita_vale_para_o_que_ela_contratou", sql: MIGRATION_024_A_AVALIACAO_DESTA_VISITA_VALE_PARA_O_QUE_ELA_CONTRATOU },
-  { id: "025_as_regras_do_atendimento_sao_configuracao", sql: MIGRATION_025_AS_REGRAS_DO_ATENDIMENTO_SAO_CONFIGURACAO }
-];
 var attendanceSettingsTab = defineSettingsTab({
   id: "clinical-attendance-rules",
   label: tl("Rules", "Regras"),