@fayz-ai/plugin-inventory 0.12.10 → 0.13.1

package/dist/index.js

@@ -1,9 +1,9 @@
-import React3, { useState, useMemo, useEffect, useCallback, useRef } from 'react';
+import React3, { useMemo, useState, useEffect, useCallback, useRef } from 'react';
 import { toast, defineKpiWidget, defineCustomWidget, PageTransition, ModulePage, Button, SubpageHeader, SearchSelect, cn, DatePicker, ListView, ConfirmDialog, Badge, DraftCommitBar, Switch, useSaveBar, DataTable, DashboardCanvas, Thumbnail, Modal, ModalContent, ModalHeader, ModalTitle, ModalDescription, ModalBody, ModalFooter, StockEntryForm, KpiCard, Card, CardHeader, CardTitle, CardContent, Skeleton } from '@fayz-ai/ui';
-import { createPluginContext, PluginSettingsPanel, dedup, useModuleNavigation, createViewRouter, ModuleActionBar, useTenantPluginSettings, SettingsGroup, ToggleRow, usePermissionOptional, CrudListView, useLimitGuard, invalidateRelationOptions, CrudFormSkeleton, CrudFormPage, CrudDetailPage, formatCurrency, useAgentSurface, askAI, PermissionGate, QuickActionsButton, invalidateLimit } from '@fayz-ai/admin';
+import { createPluginContext, PluginSettingsPanel, dedup, useTenantPluginSettings, useModuleNavigation, usePluginOnboardingGate, PluginOnboardingGateSkeleton, createViewRouter, ModuleActionBar, SettingsGroup, ToggleRow, usePermissionOptional, CrudListView, useLimitGuard, invalidateRelationOptions, CrudFormSkeleton, CrudFormPage, CrudDetailPage, formatCurrency, useAgentSurface, askAI, PermissionGate, QuickActionsButton, invalidateLimit } from '@fayz-ai/admin';
 import { createSafeDataProvider, registerTranslations, countByTenant, useTranslation, getActiveUnitId, createPendingCommand, errorMessage, useDataChanged, getSupabaseClientOptional, getActiveTenantId } from '@fayz-ai/core';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
-import { Trash2, ArrowRightLeft, RefreshCw, ArrowUpRight, ArrowDownRight, Package, Ruler, MapPin, Loader2, Check, ChevronRight, CircleSlash, CircleCheck, ClipboardCheck, AlertTriangle, Plus, BookOpen, Layers, Clock, Coins, Building2, Undo2, PackageX } from 'lucide-react';
+import { Trash2, ArrowRightLeft, RefreshCw, ArrowUpRight, ArrowDownRight, Package, Ruler, MapPin, Loader2, Check, ChevronRight, CircleSlash, CircleCheck, ListFilter, CalendarRange, PackageCheck, ClipboardCheck, AlertTriangle, Plus, BookOpen, Layers, Clock, Coins, Building2, Undo2, PackageX } from 'lucide-react';
 import { createStore as createStore$1 } from 'zustand/vanilla';
 
 // src/index.ts
@@ -2861,7 +2861,11 @@ function formatQuantity(value) {
 function formatSigned(value) {
   return value > 0 ? `+${formatQuantity(value)}` : formatQuantity(value);
 }
-function formatUsedAt(iso, locale) {
+function formatUsedAt(iso, locale, dia) {
+  if (dia && /^\d{4}-\d{2}-\d{2}$/.test(dia)) {
+    const [a, m, d] = dia.split("-");
+    return new Date(Number(a), Number(m) - 1, Number(d)).toLocaleDateString(locale, { day: "2-digit", month: "2-digit", year: "2-digit" });
+  }
   const date = new Date(iso);
   if (Number.isNaN(date.getTime())) return "\u2014";
   return date.toLocaleString(locale, {
@@ -2983,14 +2987,40 @@ function UsageAuditView() {
   const loading = useInventoryStore((s) => s.usageAuditLoading);
   const fetchUsageAudit = useInventoryStore((s) => s.fetchUsageAudit);
   const correctUsageBatch = useInventoryStore((s) => s.correctUsageBatch);
+  const approveUsageBatch = useInventoryStore((s) => s.approveUsageBatch);
+  const patchUsageAuditEntries = useInventoryStore((s) => s.patchUsageAuditEntries);
   const [search, setSearch] = useState("");
-  const [tag, setTag] = useState(void 0);
+  const [queue, setQueue] = useState("pending");
   const [drafts, setDrafts] = useState({});
   const [confirming, setConfirming] = useState(false);
   const [saving, setSaving] = useState(false);
+  const [loadedOnce, setLoadedOnce] = useState(false);
+  const [dias, setDias] = useState(30);
+  const [erro, setErro] = useState(null);
+  const desde = useMemo(() => {
+    if (dias == null) return void 0;
+    const d = /* @__PURE__ */ new Date();
+    d.setDate(d.getDate() - dias);
+    return d.toISOString();
+  }, [dias]);
   useEffect(() => {
-    fetchUsageAudit({ search: search || void 0, divergentOnly: tag === "divergent" }).catch((err) => toast.error(t2("inventory.usageAudit.loadFailed"), { description: err?.message }));
-  }, [search, tag]);
+    let active = true;
+    setErro(null);
+    fetchUsageAudit({
+      search: search || void 0,
+      divergentOnly: queue === "divergent",
+      pendingOnly: queue === "pending",
+      from: desde
+    }).catch((err) => {
+      if (active) setErro(err?.message ?? String(err));
+      toast.error(t2("inventory.usageAudit.loadFailed"), { description: err?.message });
+    }).finally(() => {
+      if (active) setLoadedOnce(true);
+    });
+    return () => {
+      active = false;
+    };
+  }, [search, queue, desde]);
   const locale = currency.locale ?? "pt-BR";
   const fieldRefs = useRef(/* @__PURE__ */ new Map());
   const order = useRef([]);
@@ -3024,6 +3054,60 @@ function UsageAuditView() {
     () => entries.filter((entry) => parseQuantity(drafts[keyOf(entry)]) === void 0).length,
     [entries, drafts]
   );
+  const [conferidas, setConferidas] = useState({});
+  const [aprovando, setAprovando] = useState(/* @__PURE__ */ new Set());
+  const aprovarLinhas = useCallback(async (alvos, baixar) => {
+    if (!alvos.length) return;
+    const chaves = alvos.map(keyOf);
+    setAprovando((prev) => /* @__PURE__ */ new Set([...prev, ...chaves]));
+    try {
+      const lines = alvos.map((e) => ({ itemId: e.itemId, productId: e.productId }));
+      const r = await approveUsageBatch({ post: baixar, lines });
+      const semSaldo = r.linesNoStock ?? 0;
+      const passaram = baixar ? r.linesPosted : r.linesApproved;
+      if (baixar && r.linesPosted === 0 && semSaldo > 0) {
+        const f = r.missing?.[0];
+        toast.warning(t2("inventory.usageAudit.noStock"), {
+          description: f ? `${f.product} \u2014 precisa ${f.needed}, h\xE1 ${f.available}` : void 0
+        });
+        return;
+      }
+      toast.success(baixar ? t2("inventory.usageAudit.posted", { count: String(r.linesPosted) }) : t2("inventory.usageAudit.approved", { count: String(r.linesApproved) }), {
+        // Um lote parcial precisa dizer quantas ficaram para trás, ou some a
+        // diferença entre "aprovei 12" e "pedi 15".
+        description: semSaldo > 0 ? t2("inventory.usageAudit.batchNoStock", { count: String(semSaldo) }) : void 0
+      });
+      if (semSaldo > 0 || passaram !== alvos.length) {
+        await fetchUsageAudit({
+          search: search || void 0,
+          divergentOnly: queue === "divergent",
+          pendingOnly: queue === "pending",
+          from: desde
+        });
+        return;
+      }
+      patchUsageAuditEntries(lines, { isCorrected: true, ...baixar ? { stockPosted: true } : {} });
+      setConferidas((prev) => {
+        const next = { ...prev };
+        for (const k of chaves) next[k] = baixar ? "posted" : "approved";
+        return next;
+      });
+    } catch (err) {
+      toast.error(t2("inventory.usageAudit.approveFailed"), { description: err?.message });
+    } finally {
+      setAprovando((prev) => {
+        const next = new Set(prev);
+        for (const k of chaves) next.delete(k);
+        return next;
+      });
+    }
+  }, [approveUsageBatch, patchUsageAuditEntries, fetchUsageAudit, search, queue, desde, t2]);
+  const conferidasRef = useRef(conferidas);
+  conferidasRef.current = conferidas;
+  const aprovandoRef = useRef(aprovando);
+  aprovandoRef.current = aprovando;
+  const aprovarLinhasRef = useRef(aprovarLinhas);
+  aprovarLinhasRef.current = aprovarLinhas;
   async function apply(reason) {
     setSaving(true);
     try {
@@ -3048,10 +3132,17 @@ function UsageAuditView() {
       header: t2("inventory.usageAudit.columnProduct"),
       cell: ({ row }) => {
         const entry = row.original;
-        return /* @__PURE__ */ jsxs("div", { className: "min-w-[10rem]", children: [
-          /* @__PURE__ */ jsx("div", { className: "font-medium", children: entry.productName ?? t2("inventory.usageAudit.unnamedProduct") }),
-          entry.itemName && entry.itemName !== entry.productName && /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground", children: entry.itemName })
-        ] });
+        return (
+          /* NOME LONGO NÃO EMPURRA A TABELA. "Ao Redor da Boca e Código de
+             Barras - Ultraformer" alargava a coluna e espremia quantidade,
+             profissional e as ações para fora da tela. Aqui o nome tem teto e
+             corta com reticências — o inteiro fica no `title`, a um passar de
+             mouse, e a linha continua legível no celular. */
+          /* @__PURE__ */ jsxs("div", { className: "min-w-[10rem] max-w-[18rem]", children: [
+            /* @__PURE__ */ jsx("div", { className: "truncate font-medium", title: entry.productName ?? void 0, children: entry.productName ?? t2("inventory.usageAudit.unnamedProduct") }),
+            entry.itemName && entry.itemName !== entry.productName && /* @__PURE__ */ jsx("div", { className: "truncate text-xs text-muted-foreground", title: entry.itemName, children: entry.itemName })
+          ] })
+        );
       }
     },
     {
@@ -3072,7 +3163,14 @@ function UsageAuditView() {
             formatQuantity(entry.standardQuantity),
             unit
           ] }),
-          entry.isCorrected && /* @__PURE__ */ jsx(Badge, { variant: "outline", className: "ml-2 text-[10px]", children: t2("inventory.usageAudit.corrected") })
+          (entry.isCorrected || conferidasRef.current[keyOf(entry)]) && /* @__PURE__ */ jsx(
+            Badge,
+            {
+              variant: conferidasRef.current[keyOf(entry)] ? "success" : "outline",
+              className: "ml-2 text-[10px]",
+              children: conferidasRef.current[keyOf(entry)] === "posted" ? t2("inventory.usageAudit.badgePosted") : conferidasRef.current[keyOf(entry)] === "approved" ? t2("inventory.usageAudit.badgeApproved") : t2("inventory.usageAudit.corrected")
+            }
+          )
         ] });
       }
     },
@@ -3090,14 +3188,14 @@ function UsageAuditView() {
     {
       id: "usedAt",
       header: t2("inventory.usageAudit.columnWhen"),
-      cell: ({ row }) => /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground whitespace-nowrap", children: formatUsedAt(row.original.usedAt, locale) })
+      cell: ({ row }) => /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground whitespace-nowrap", children: formatUsedAt(row.original.usedAt, locale, row.original.movementDate) })
     },
     {
       id: "performedBy",
       header: t2("inventory.usageAudit.columnPerformedBy"),
       cell: ({ row }) => {
         const entry = row.original;
-        return /* @__PURE__ */ jsx("span", { className: "text-xs whitespace-nowrap", children: entry.performedByName ?? /* @__PURE__ */ jsx("span", { className: "text-muted-foreground", children: "\u2014" }) });
+        return /* @__PURE__ */ jsx("span", { className: "block max-w-[10rem] truncate text-xs", title: entry.performedByName ?? void 0, children: entry.performedByName ?? /* @__PURE__ */ jsx("span", { className: "text-muted-foreground", children: "\u2014" }) });
       }
     },
     {
@@ -3105,7 +3203,7 @@ function UsageAuditView() {
       header: t2("inventory.usageAudit.columnCustomer"),
       cell: ({ row }) => {
         const entry = row.original;
-        return /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground whitespace-nowrap", children: entry.customerName ?? "\u2014" });
+        return /* @__PURE__ */ jsx("span", { className: "block max-w-[12rem] truncate text-xs text-muted-foreground", title: entry.customerName ?? void 0, children: entry.customerName ?? "\u2014" });
       }
     },
     {
@@ -3132,35 +3230,119 @@ function UsageAuditView() {
           }
         );
       }
+    },
+    {
+      // AS DUAS AÇÕES DO V1, na linha, com os verbos dele.
+      //
+      // "Baixar no estoque" aceita E desconta; "Aprovar" aceita e não mexe no
+      // saldo — é o consumo que não sai da prateleira da casa (produto do
+      // próprio cliente, amostra, item já baixado por fora). Separá-las é o
+      // que impede que conferir vire baixa automática.
+      id: "acoes",
+      header: () => /* @__PURE__ */ jsx("span", { className: "block text-right", children: t2("inventory.usageAudit.columnActions") }),
+      cell: ({ row }) => {
+        const entry = row.original;
+        const key = keyOf(entry);
+        const feito = !!conferidasRef.current[key];
+        const ocupado = aprovandoRef.current.has(key);
+        if (feito) return /* @__PURE__ */ jsx("span", { className: "block text-right text-xs text-muted-foreground", children: "\u2014" });
+        return /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-end gap-1", children: [
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              disabled: ocupado,
+              onClick: () => void aprovarLinhasRef.current([entry], true),
+              title: t2("inventory.usageAudit.postHint"),
+              className: "rounded-button bg-foreground px-2 py-1 text-[11px] font-semibold text-background disabled:opacity-40",
+              children: t2("inventory.usageAudit.post")
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              disabled: ocupado,
+              onClick: () => void aprovarLinhasRef.current([entry], false),
+              title: t2("inventory.usageAudit.approveHint"),
+              className: "rounded-button border border-input px-2 py-1 text-[11px] font-medium hover:bg-muted disabled:opacity-40",
+              children: t2("inventory.usageAudit.approve")
+            }
+          )
+        ] });
+      }
     }
+    // As colunas NÃO dependem de `conferidas` nem de `aprovando`: refazê-las
+    // remonta a célula do campo aberto e leva o foco junto — o mesmo motivo que
+    // já obrigava `draftsRef`. As duas leituras voláteis vão por ref, e quem
+    // repinta a linha é o `usageAudit` do store, que a aprovação acabou de
+    // mudar.
   ], [currency, locale, t2, setDraft, focusNext, registerRef]);
   const costDelta = summary.varianceValue;
-  return /* @__PURE__ */ jsxs("div", { className: "space-y-4", children: [
-    /* @__PURE__ */ jsx(
-      SubpageHeader,
-      {
-        title: t2("inventory.usageAudit.title"),
-        subtitle: t2("inventory.usageAudit.subtitle")
-      }
-    ),
+  return /* @__PURE__ */ jsxs("div", { className: "space-y-3", children: [
+    erro && /* @__PURE__ */ jsxs("p", { className: "rounded-xl border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: [
+      t2("inventory.usageAudit.loadFailed"),
+      " \u2014 ",
+      erro
+    ] }),
     /* @__PURE__ */ jsx(
       ListView,
       {
         columns,
         data: entries,
-        loading,
+        loading: loading || !loadedOnce,
         total,
         getRowId: (row) => keyOf(row),
+        bulkActions: [
+          {
+            id: "post",
+            label: t2("inventory.usageAudit.post"),
+            icon: PackageCheck,
+            onSelect: (rows) => aprovarLinhas(rows.filter((r) => !conferidas[keyOf(r)]), true)
+          },
+          {
+            id: "approve",
+            label: t2("inventory.usageAudit.approve"),
+            icon: Check,
+            onSelect: (rows) => aprovarLinhas(rows.filter((r) => !conferidas[keyOf(r)]), false)
+          }
+        ],
         searchPlaceholder: t2("inventory.usageAudit.searchPlaceholder"),
         search,
         onSearchChange: setSearch,
         searchDebounce: 300,
-        tags: [{ value: "divergent", label: t2("inventory.usageAudit.filterDivergent") }],
-        tagsLabel: t2("inventory.usageAudit.filterLabel"),
-        allTagLabel: t2("inventory.usageAudit.filterAll"),
-        activeTag: tag,
-        onTagChange: setTag,
-        emptyMessage: tag === "divergent" ? t2("inventory.usageAudit.emptyDivergent") : t2("inventory.usageAudit.empty")
+        filterDefs: [
+          {
+            id: "queue",
+            label: t2("inventory.usageAudit.filterLabel"),
+            icon: ListFilter,
+            allLabel: t2("inventory.usageAudit.filterAll"),
+            options: [
+              { value: "pending", label: t2("inventory.usageAudit.filterPending") },
+              { value: "divergent", label: t2("inventory.usageAudit.filterDivergent") }
+            ],
+            value: queue === "all" ? void 0 : queue,
+            onChange: (v) => setQueue(v ?? "all")
+          },
+          {
+            id: "period",
+            label: t2("inventory.usageAudit.periodLabel"),
+            icon: CalendarRange,
+            allLabel: t2("inventory.usageAudit.periodAll"),
+            options: [
+              { value: "30", label: t2("inventory.usageAudit.period30") },
+              { value: "90", label: t2("inventory.usageAudit.period90") }
+            ],
+            value: dias == null ? void 0 : String(dias),
+            onChange: (v) => setDias(v ? Number(v) : null)
+          }
+        ],
+        filtersLabel: t2("inventory.usageAudit.filtersLabel"),
+        onClearFilters: () => {
+          setQueue("all");
+          setDias(null);
+        },
+        emptyMessage: erro ? t2("inventory.usageAudit.loadFailed") : queue === "divergent" ? t2("inventory.usageAudit.emptyDivergent") : queue === "pending" ? t2("inventory.usageAudit.emptyPending") : t2("inventory.usageAudit.empty")
       }
     ),
     /* @__PURE__ */ jsx(
@@ -3190,6 +3372,9 @@ function UsageAuditView() {
     )
   ] });
 }
+var INVENTORY_MODULE_DEFAULTS = {
+  recipes: true
+};
 var INVENTORY_DEFAULTS = {
   lowStockAlerts: true,
   requireReason: true,
@@ -3199,10 +3384,20 @@ var INVENTORY_DEFAULTS = {
   lowStockEmail: false,
   expiryWarnings: true
 };
-function InventoryGeneralSettings() {
+function InventoryGeneralSettings({ config }) {
   const t2 = useTranslation();
   const s = useTenantPluginSettings("inventory", INVENTORY_DEFAULTS);
+  const mods = useTenantPluginSettings("inventory", INVENTORY_MODULE_DEFAULTS);
   return /* @__PURE__ */ jsxs("div", { className: "space-y-4", children: [
+    config?.modules.recipes && /* @__PURE__ */ jsx(SettingsGroup, { title: t2("inventory.settings.modules"), description: t2("inventory.settings.modulesDesc"), children: /* @__PURE__ */ jsx(
+      ToggleRow,
+      {
+        label: t2("inventory.settings.recipes"),
+        description: t2("inventory.settings.recipesDesc"),
+        checked: mods.get("recipes"),
+        onChange: (v) => mods.set("recipes", v)
+      }
+    ) }),
     /* @__PURE__ */ jsxs(SettingsGroup, { title: t2("inventory.settings.stockManagement"), description: t2("inventory.settings.stockManagementDesc"), children: [
       /* @__PURE__ */ jsx(ToggleRow, { label: t2("inventory.settings.lowStockAlerts"), description: t2("inventory.settings.lowStockAlertsDesc"), checked: s.get("lowStockAlerts"), onChange: (v) => s.set("lowStockAlerts", v) }),
       /* @__PURE__ */ jsx(ToggleRow, { label: t2("inventory.settings.requireReason"), description: t2("inventory.settings.requireReasonDesc"), checked: s.get("requireReason"), onChange: (v) => s.set("requireReason", v) }),
@@ -3294,36 +3489,53 @@ function buildNav(config, view, navigate, t2) {
         { id: "stock-history", label: t2("inventory.nav.history"), defaultChild: true, active: view === "stock-history", onClick: () => navigate("stock-history") }
       ]
     },
-    // Inventário — conferir o que o sistema diz contra o que existe na
-    // prateleira. Contagem e auditoria de uso respondem à mesma pergunta por
-    // dois caminhos (contar e comparar consumo), e nenhuma das duas é uma
-    // movimentação: viviam como pílula de Movimentações e ninguém as achava.
+    // Contagem e Auditoria de Uso são ABAS, não uma rubrica com pílula dentro.
+    //
+    // Conferir o que o sistema diz contra o que existe na prateleira são duas
+    // TELAS, cada uma com a sua lista e o seu fechamento — e agrupá-las sob
+    // "Inventário" punha o segundo nível num controle segmentado à direita da
+    // faixa, que é onde ninguém procura uma tela. A faixa é o lugar de uma
+    // tela; a pílula é o lugar de um recorte da mesma tela.
+    //
+    // "Nova contagem" saiu junto: era uma AÇÃO dentro de navegação, e a lista
+    // de contagens já tem o "+" no cabeçalho dela.
     {
-      id: "inventory-check",
-      label: t2("inventory.nav.inventory"),
+      id: "stock-counts",
+      label: t2("inventory.nav.counts"),
       icon: "ClipboardCheck",
-      children: [
-        { id: "stock-counts-new", kind: "action", label: t2("inventory.nav.new"), active: view === "stock-counts-new", onClick: () => navigate("stock-counts-new") },
-        { id: "stock-counts", label: t2("inventory.nav.counts"), defaultChild: true, active: view === "stock-counts" || view.startsWith("stock-counts"), onClick: () => navigate("stock-counts") },
-        { id: "stock-usage-audit", label: t2("inventory.nav.usageAudit"), active: view === "stock-usage-audit", onClick: () => navigate("stock-usage-audit") }
-      ]
+      active: view === "stock-counts" || view.startsWith("stock-counts"),
+      onClick: () => navigate("stock-counts")
+    },
+    {
+      id: "stock-usage-audit",
+      label: t2("inventory.nav.usageAudit"),
+      icon: "ScanSearch",
+      active: view === "stock-usage-audit",
+      onClick: () => navigate("stock-usage-audit")
     }
   ];
   if (config.modules.recipes) {
+    const rotulo = (chave, escolhido, padrao) => escolhido && escolhido !== padrao ? escolhido : t2(chave);
     items.push({
       id: "recipes",
-      label: config.labels.recipes,
+      label: rotulo("inventory.nav.recipes", config.labels.recipes, "Recipes"),
       icon: "BookOpen",
       children: [
-        { id: "recipes-list", label: config.labels.recipesList, active: view === "recipes-list" || view.startsWith("recipes-detail:"), onClick: () => navigate("recipes-list") },
-        { id: "recipes-new", kind: "action", label: config.labels.recipesNew, active: view === "recipes-new", onClick: () => navigate("recipes-new") }
+        { id: "recipes-list", label: rotulo("inventory.nav.list", config.labels.recipesList, "List"), active: view === "recipes-list" || view.startsWith("recipes-detail:"), onClick: () => navigate("recipes-list") },
+        { id: "recipes-new", kind: "action", label: rotulo("inventory.nav.new", config.labels.recipesNew, "New"), active: view === "recipes-new", onClick: () => navigate("recipes-new") }
       ]
     });
   }
   return items;
 }
-function InventoryPage({ config, provider, store, registries }) {
+function InventoryPage({ config: appConfig, provider, store, registries }) {
   const t2 = useTranslation();
+  const houseModules = useTenantPluginSettings("inventory", INVENTORY_MODULE_DEFAULTS);
+  const recipesOn = houseModules.get("recipes");
+  const config = useMemo(
+    () => appConfig.modules.recipes && recipesOn ? appConfig : { ...appConfig, modules: { ...appConfig.modules, recipes: false } },
+    [appConfig, recipesOn]
+  );
   const { view, direction, navigate } = useModuleNavigation("/inventory", {
     dashboard: 0,
     "products-list": 0,
@@ -3340,24 +3552,18 @@ function InventoryPage({ config, provider, store, registries }) {
     "recipes-detail": 1,
     settings: 1
   }, "dashboard");
-  const [onboardingComplete, setOnboardingComplete] = useState(() => {
-    try {
-      return localStorage.getItem("saas-core:inventory-onboarded") === "true";
-    } catch {
-      return false;
-    }
-  });
+  const checkExistingData = React3.useCallback(
+    async () => (await provider.getProducts({ pageSize: 1 })).total > 0,
+    [provider]
+  );
+  const onboarding = usePluginOnboardingGate("saas-core:inventory-onboarded", checkExistingData);
   const isSettings = view === "settings";
   const isSummary = view === "dashboard" || view === "";
   const nav = buildNav(config, view, navigate, t2);
   const completeOnboarding = React3.useCallback(async () => {
     await provider.ensureReferenceData?.();
-    setOnboardingComplete(true);
-    try {
-      localStorage.setItem("saas-core:inventory-onboarded", "true");
-    } catch {
-    }
-  }, [provider]);
+    onboarding.complete();
+  }, [provider, onboarding.complete]);
   const quickActions = useMemo(() => {
     const actions = [
       // Dropped with the catalogue module: offering "new product" while the
@@ -3386,7 +3592,10 @@ function InventoryPage({ config, provider, store, registries }) {
     ];
     return actions;
   }, []);
-  if (!onboardingComplete) {
+  if (isSummary && onboarding.status === "checking") {
+    return /* @__PURE__ */ jsx(InventoryContextProvider, { config, provider, store, children: /* @__PURE__ */ jsx(PluginOnboardingGateSkeleton, {}) });
+  }
+  if (isSummary && onboarding.status === "needed") {
     return /* @__PURE__ */ jsx(InventoryContextProvider, { config, provider, store, children: /* @__PURE__ */ jsx(InventoryOnboarding, { onComplete: completeOnboarding }) });
   }
   if (isSettings && registries && registries.length > 0) {
@@ -3399,7 +3608,7 @@ function InventoryPage({ config, provider, store, registries }) {
         PluginSettingsPanel,
         {
           title: t2("inventory.settingsPage.title"),
-          generalSettings: /* @__PURE__ */ jsx(InventoryGeneralSettings, {}),
+          generalSettings: /* @__PURE__ */ jsx(InventoryGeneralSettings, { config: appConfig }),
           registries,
           hostPluginId: "inventory",
           routeBase: "/inventory/settings"
@@ -4378,7 +4587,8 @@ function camelToSnake(obj) {
 }
 var PRODUCT_SELECT = `*, ${T.productDetails}(*)`;
 var PRODUCTS_READ = "v_inventory_products";
-var USAGE_AUDIT_READ = "v_inventory_usage_audit";
+var soMercadoria = (qb) => qb.neq("kind", "service");
+var USAGE_AUDIT_READ = "v_inventory_consumption_audit";
 async function defaultLocationId(pub, tenantId) {
   if (!tenantId) return void 0;
   const { data } = await pub.from("plg_inventory_stock_locations").select("id").eq("tenant_id", tenantId).eq("is_active", true).order("created_at").limit(1);
@@ -4658,7 +4868,7 @@ function createSupabaseInventoryProvider() {
     async getProducts(query) {
       const { core} = getClients();
       const select = query.categoryId ? `*, ${T.productDetails}!inner(*)` : PRODUCT_SELECT;
-      let qb = core.from(PRODUCTS_READ).select(select, { count: "exact" });
+      let qb = soMercadoria(core.from(PRODUCTS_READ).select(select, { count: "exact" }));
       if (query.search) qb = qb.ilike("name", `%${query.search}%`);
       if (query.productType) qb = qb.eq("metadata->>productType", query.productType);
       if (query.categoryId) qb = qb.eq(`${T.productDetails}.category_id`, query.categoryId);
@@ -5243,8 +5453,12 @@ function createSupabaseInventoryProvider() {
     // --- Usage audit ---
     async getUsageAudit(query) {
       const { pub } = getClients();
-      let qb = pub.from(USAGE_AUDIT_READ).select("*", { count: "exact" });
+      let qb = pub.from(USAGE_AUDIT_READ).select("*", { count: "planned" });
       if (query.divergentOnly) qb = qb.not("variance", "is", null).neq("variance", 0);
+      if (query.pendingOnly) qb = qb.eq("is_corrected", false);
+      const unidade = getActiveUnitId();
+      if (unidade) qb = qb.eq("unit_id", unidade);
+      if (query.from) qb = qb.gte("used_at", query.from);
       if (query.search) {
         const like = `%${query.search.replace(/[(),]/g, " ").trim()}%`;
         qb = qb.or(
@@ -5256,6 +5470,12 @@ function createSupabaseInventoryProvider() {
       qb = qb.range((page - 1) * pageSize, page * pageSize - 1).order("used_at", { ascending: false });
       const { data, count, error } = await qb;
       if (error) throw new Error(error.message);
+      const ids = [...new Set((data ?? []).flatMap((r) => [r.performed_by_id, r.customer_id]).filter(Boolean))];
+      const nomes = /* @__PURE__ */ new Map();
+      if (ids.length) {
+        const { data: pessoas } = await pub.from("people").select("id, name").in("id", ids);
+        for (const p of pessoas ?? []) nomes.set(p.id, p.name);
+      }
       const entries = (data ?? []).map((r) => ({
         itemId: r.item_id,
         productId: r.product_id,
@@ -5280,12 +5500,17 @@ function createSupabaseInventoryProvider() {
         itemName: r.item_name ?? void 0,
         orderReference: r.order_reference ?? void 0,
         performedById: r.performed_by_id ?? void 0,
-        performedByName: r.performed_by_name ?? void 0,
+        performedByName: r.performed_by_name ?? nomes.get(r.performed_by_id) ?? void 0,
         customerId: r.customer_id ?? void 0,
-        customerName: r.customer_name ?? void 0,
+        customerName: r.customer_name ?? nomes.get(r.customer_id) ?? void 0,
         correctedAt: r.corrected_at ?? void 0,
         correctionReason: r.correction_reason ?? void 0,
-        isCorrected: Boolean(r.is_corrected)
+        isCorrected: Boolean(r.is_corrected),
+        // `ledger` quando o pedido baixou estoque, `clinical` quando o
+        // atendimento consumiu e nada saiu do razão. Sem isto a tela não
+        // consegue dizer ao operador que aquela linha nunca baixou.
+        source: r.source ?? void 0,
+        stockPosted: r.stock_posted == null ? void 0 : Boolean(r.stock_posted)
       }));
       return { data: entries, total: count ?? 0 };
     },
@@ -5299,6 +5524,27 @@ function createSupabaseInventoryProvider() {
       });
       if (error) throw new Error(error.message);
     },
+    async approveUsageBatch(input) {
+      const { pub } = getClients();
+      const { data, error } = await pub.rpc("inventory_approve_usage_batch", {
+        p_lines: input.lines.map((l) => ({ item_id: l.itemId, product_id: l.productId })),
+        p_post: input.post,
+        p_reason: input.reason ?? null
+      });
+      if (error) throw new Error(error.message);
+      const r = data ?? {};
+      return {
+        linesApproved: Number(r.lines_approved ?? 0),
+        linesPosted: Number(r.lines_posted ?? 0),
+        linesSkipped: Number(r.lines_skipped ?? 0),
+        linesNoStock: Number(r.lines_no_stock ?? 0),
+        missing: (r.missing ?? []).map((m) => ({
+          product: m.product,
+          needed: Number(m.needed ?? 0),
+          available: Number(m.available ?? 0)
+        }))
+      };
+    },
     async correctUsageBatch(input) {
       const { pub } = getClients();
       const { data, error } = await pub.rpc("inventory_correct_usage_batch", {
@@ -5322,7 +5568,9 @@ function createSupabaseInventoryProvider() {
     // --- Summary ---
     async getSummary() {
       const { core, pub } = getClients();
-      const { data: products2 } = await core.from(PRODUCTS_READ).select("stock, min_stock, price, is_active").eq("is_active", true);
+      const { data: products2 } = await soMercadoria(
+        core.from(PRODUCTS_READ).select("stock, min_stock, price, is_active").eq("is_active", true)
+      );
       const items = products2 ?? [];
       const lowStock = items.filter((p) => p.stock > 0 && p.stock <= (p.min_stock ?? 0));
       const outOfStock = items.filter((p) => p.stock <= 0);
@@ -5347,7 +5595,7 @@ function createSupabaseInventoryProvider() {
     },
     async getRestockList(limit = 50) {
       const { core, pub } = getClients();
-      const { data } = await core.from(PRODUCTS_READ).select("id, name, category_id, stock, min_stock, unit").eq("is_active", true);
+      const { data } = await soMercadoria(core.from(PRODUCTS_READ).select("id, name, category_id, stock, min_stock, unit").eq("is_active", true));
       const rows = data ?? [];
       const needs = rows.map((r) => ({
         productId: r.id,
@@ -5374,7 +5622,9 @@ function createSupabaseInventoryProvider() {
     },
     async getCategoryDistribution() {
       const { core, pub } = getClients();
-      const { data } = await core.from(PRODUCTS_READ).select("category_id").eq("is_active", true);
+      const { data } = await soMercadoria(
+        core.from(PRODUCTS_READ).select("category_id").eq("is_active", true)
+      );
       const rows = data ?? [];
       const tally = /* @__PURE__ */ new Map();
       for (const r of rows) tally.set(r.category_id ?? null, (tally.get(r.category_id ?? null) ?? 0) + 1);
@@ -5418,57 +5668,59 @@ function createInventoryStore(provider) {
     categoryMix: null,
     async fetchRestock() {
       if (!provider.getRestockList) return;
-      return dedup("inv:restock", async () => {
-        try {
-          set({ restock: await provider.getRestockList() });
-        } catch {
-          set({ restock: [] });
-        }
-      });
+      try {
+        set({ restock: await dedup("inv:restock", () => provider.getRestockList()) });
+      } catch {
+        set({ restock: [] });
+      }
     },
     async fetchCategoryMix() {
       if (!provider.getCategoryDistribution) return;
-      return dedup("inv:category-mix", async () => {
-        try {
-          set({ categoryMix: await provider.getCategoryDistribution() });
-        } catch {
-          set({ categoryMix: [] });
-        }
-      });
+      try {
+        set({ categoryMix: await dedup("inv:category-mix", () => provider.getCategoryDistribution()) });
+      } catch {
+        set({ categoryMix: [] });
+      }
     },
     async fetchSummary() {
-      return dedup("inv:summary", async () => {
-        set({ summaryLoading: true });
-        const summary = await provider.getSummary();
-        set({ summary, summaryLoading: false });
-      });
+      set({ summaryLoading: true });
+      try {
+        set({ summary: await dedup("inv:summary", () => provider.getSummary()), summaryLoading: false });
+      } catch (err) {
+        set({ summaryLoading: false });
+        throw err;
+      }
     },
     async fetchProducts(query) {
       const key = "inv:products:" + JSON.stringify(query);
-      return dedup(key, async () => {
-        set({ productsLoading: true, productQuery: query });
-        const result = await provider.getProducts(query);
+      set({ productsLoading: true, productQuery: query });
+      try {
+        const result = await dedup(key, () => provider.getProducts(query));
         set({ products: result.data, productsTotal: result.total, productsLoading: false });
-      });
+      } catch (err) {
+        set({ productsLoading: false });
+        throw err;
+      }
     },
     async fetchMovements(query) {
-      return dedup("inv:movements:" + JSON.stringify(query), async () => {
-        set({ movementsLoading: true });
-        const result = await provider.getMovements(query);
+      set({ movementsLoading: true });
+      try {
+        const result = await dedup("inv:movements:" + JSON.stringify(query), () => provider.getMovements(query));
         set({ movements: result.data, movementsTotal: result.total, movementsLoading: false });
-      });
+      } catch (err) {
+        set({ movementsLoading: false });
+        throw err;
+      }
     },
     async fetchUsageAudit(query) {
-      return dedup("inv:usage-audit:" + JSON.stringify(query), async () => {
-        set({ usageAuditLoading: true, usageAuditQuery: query });
-        try {
-          const result = await provider.getUsageAudit(query);
-          set({ usageAudit: result.data, usageAuditTotal: result.total, usageAuditLoading: false });
-        } catch (err) {
-          set({ usageAuditLoading: false });
-          throw err;
-        }
-      });
+      set({ usageAuditLoading: true, usageAuditQuery: query });
+      try {
+        const result = await dedup("inv:usage-audit:" + JSON.stringify(query), () => provider.getUsageAudit(query));
+        set({ usageAudit: result.data, usageAuditTotal: result.total, usageAuditLoading: false });
+      } catch (err) {
+        set({ usageAuditLoading: false });
+        throw err;
+      }
     },
     async correctUsage(input) {
       await provider.correctUsage(input);
@@ -5478,6 +5730,28 @@ function createInventoryStore(provider) {
       ]);
       set({ usageAudit: result.data, usageAuditTotal: result.total, summary });
     },
+    async approveUsageBatch(input) {
+      if (!provider.approveUsageBatch) throw new Error("inventory: provider has no approveUsageBatch");
+      return provider.approveUsageBatch(input);
+    },
+    // CONFERIR NÃO É RECARREGAR.
+    //
+    // Aprovar uma linha recarregava a fila inteira — e a fila do Espaço Facial
+    // custa 0,65 s no banco com a janela curta, mais o tempo de montar 50
+    // linhas. Quem confere desce a lista aprovando uma a uma: cada clique
+    // jogava a tabela fora, refazia a rolagem e tirava do lugar a linha
+    // seguinte, que é justamente onde a pessoa ia clicar.
+    //
+    // O servidor já disse o que aconteceu; a tela só precisa dizer o mesmo.
+    // Nenhum `set` aqui inventa estado: `isCorrected` e `stockPosted` são os
+    // dois campos que a aprovação de fato escreveu.
+    patchUsageAuditEntries(lines, patch) {
+      if (!lines.length) return;
+      const alvo = new Set(lines.map((l) => `${l.itemId}:${l.productId}`));
+      set((state) => ({
+        usageAudit: state.usageAudit.map((entry) => alvo.has(`${entry.itemId}:${entry.productId}`) ? { ...entry, ...patch } : entry)
+      }));
+    },
     async correctUsageBatch(input) {
       const outcome = await provider.correctUsageBatch(input);
       const [result, summary] = await Promise.all([
@@ -5488,11 +5762,13 @@ function createInventoryStore(provider) {
       return outcome;
     },
     async fetchLocations() {
-      return dedup("inv:locations", async () => {
-        set({ locationsLoading: true });
-        const locations = await provider.getLocations();
-        set({ locations, locationsLoading: false });
-      });
+      set({ locationsLoading: true });
+      try {
+        set({ locations: await dedup("inv:locations", () => provider.getLocations()), locationsLoading: false });
+      } catch (err) {
+        set({ locationsLoading: false });
+        throw err;
+      }
     },
     async fetchRecipes() {
       set({ recipesLoading: true });
@@ -6087,6 +6363,10 @@ var en = {
   "inventory.quickActions.stockExitDesc": "Record goods used or sold",
   "inventory.settingsPage.title": "Inventory Settings",
   "inventory.settingsPage.subtitle": "Manage units, categories, and stock locations",
+  "inventory.settings.modules": "Modules",
+  "inventory.settings.modulesDesc": "What this house shows inside Inventory",
+  "inventory.settings.recipes": "Recipes",
+  "inventory.settings.recipesDesc": "The bill of materials that says what each product consumes",
   "inventory.settings.stockManagement": "Stock Management",
   "inventory.settings.stockManagementDesc": "How stock levels are tracked",
   "inventory.settings.lowStockAlerts": "Low stock alerts",
@@ -6352,6 +6632,9 @@ var en = {
   "inventory.usageAudit.columnCustomer": "Customer",
   "inventory.usageAudit.columnCost": "Cost",
   "inventory.usageAudit.standard": "Standard",
+  "inventory.usageAudit.badgePosted": "Posted",
+  "inventory.usageAudit.badgeApproved": "Approved",
+  "inventory.usageAudit.batchNoStock": "{count} without stock \u2014 still queued",
   "inventory.usageAudit.corrected": "Corrected",
   "inventory.usageAudit.noLocation": "No position",
   "inventory.usageAudit.unnamedProduct": "Unnamed product",
@@ -6359,6 +6642,22 @@ var en = {
   "inventory.usageAudit.cancel": "Cancel",
   "inventory.usageAudit.loadFailed": "Could not load the audit",
   "inventory.usageAudit.searchPlaceholder": "Search by product, customer, professional\u2026",
+  "inventory.usageAudit.periodLabel": "Period",
+  "inventory.usageAudit.period30": "30 days",
+  "inventory.usageAudit.period90": "90 days",
+  "inventory.usageAudit.periodAll": "All time",
+  "inventory.usageAudit.filterPending": "Pending",
+  "inventory.usageAudit.emptyPending": "No usage waiting for review in this period.",
+  "inventory.usageAudit.columnActions": "Actions",
+  "inventory.usageAudit.post": "Post",
+  "inventory.usageAudit.approve": "Approve",
+  "inventory.usageAudit.postHint": "Accepts the usage AND deducts stock",
+  "inventory.usageAudit.approveHint": "Accepts the usage without touching stock",
+  "inventory.usageAudit.posted": "{{count}} line(s) posted to stock",
+  "inventory.usageAudit.approved": "{{count}} line(s) approved",
+  "inventory.usageAudit.approveFailed": "Could not accept the usage",
+  "inventory.usageAudit.noStock": "No stock to post \u2014 receive the product or use Approve",
+  "inventory.usageAudit.filtersLabel": "Filters",
   "inventory.usageAudit.filterLabel": "Review",
   "inventory.usageAudit.filterAll": "All",
   "inventory.usageAudit.filterDivergent": "Off standard",
@@ -6540,6 +6839,10 @@ var ptBR = {
   "inventory.quickActions.stockExitDesc": "Registrar mercadorias usadas ou vendidas",
   "inventory.settingsPage.title": "Configura\xE7\xF5es de Estoque",
   "inventory.settingsPage.subtitle": "Gerenciar unidades, categorias e locais de estoque",
+  "inventory.settings.modules": "M\xF3dulos",
+  "inventory.settings.modulesDesc": "O que desta casa aparece no Estoque",
+  "inventory.settings.recipes": "Receitas",
+  "inventory.settings.recipesDesc": "A ficha t\xE9cnica que diz quanto cada produto consome",
   "inventory.settings.stockManagement": "Gest\xE3o de Estoque",
   "inventory.settings.stockManagementDesc": "Como os n\xEDveis de estoque s\xE3o rastreados",
   "inventory.settings.lowStockAlerts": "Alertas de estoque baixo",
@@ -6805,6 +7108,9 @@ var ptBR = {
   "inventory.usageAudit.columnCustomer": "Cliente",
   "inventory.usageAudit.columnCost": "Custo",
   "inventory.usageAudit.standard": "Padr\xE3o",
+  "inventory.usageAudit.badgePosted": "Baixado",
+  "inventory.usageAudit.badgeApproved": "Aprovado",
+  "inventory.usageAudit.batchNoStock": "{count} sem saldo \u2014 seguem na fila",
   "inventory.usageAudit.corrected": "Corrigido",
   "inventory.usageAudit.noLocation": "Sem posi\xE7\xE3o",
   "inventory.usageAudit.unnamedProduct": "Produto sem nome",
@@ -6812,6 +7118,22 @@ var ptBR = {
   "inventory.usageAudit.cancel": "Cancelar",
   "inventory.usageAudit.loadFailed": "N\xE3o foi poss\xEDvel carregar a auditoria",
   "inventory.usageAudit.searchPlaceholder": "Buscar por produto, cliente, profissional\u2026",
+  "inventory.usageAudit.periodLabel": "Per\xEDodo",
+  "inventory.usageAudit.period30": "30 dias",
+  "inventory.usageAudit.period90": "90 dias",
+  "inventory.usageAudit.periodAll": "Todo o per\xEDodo",
+  "inventory.usageAudit.filterPending": "Pendentes",
+  "inventory.usageAudit.emptyPending": "Nenhum consumo esperando confer\xEAncia neste per\xEDodo.",
+  "inventory.usageAudit.columnActions": "A\xE7\xF5es",
+  "inventory.usageAudit.post": "Baixar",
+  "inventory.usageAudit.approve": "Aprovar",
+  "inventory.usageAudit.postHint": "Aceita o consumo E desconta do saldo",
+  "inventory.usageAudit.approveHint": "Aceita o consumo sem mexer no saldo",
+  "inventory.usageAudit.posted": "{{count}} linha(s) baixada(s) do estoque",
+  "inventory.usageAudit.approved": "{{count}} linha(s) aprovada(s)",
+  "inventory.usageAudit.approveFailed": "N\xE3o foi poss\xEDvel aceitar o consumo",
+  "inventory.usageAudit.noStock": "Sem saldo para baixar \u2014 d\xEA entrada no produto ou use Aprovar",
+  "inventory.usageAudit.filtersLabel": "Filtros",
   "inventory.usageAudit.filterLabel": "Confer\xEAncia",
   "inventory.usageAudit.filterAll": "Tudo",
   "inventory.usageAudit.filterDivergent": "Fora do padr\xE3o",
@@ -11381,13 +11703,3604 @@ VALUES ('stock_positions',
 -- Esta linha \xE9 global (sem tenant), ent\xE3o \xE9 o \xEDndice global que ela quer.
 ON CONFLICT (source_table) WHERE tenant_id IS NULL DO UPDATE SET reason = EXCLUDED.reason;
 `;
+var MIGRATION_006_A_PRODUCAO_TEM_ORDEM_E_ESTACAO = `-- A produ\xE7\xE3o tem ordem e esta\xE7\xE3o.
+--
+-- O Pertinho do C\xE9u produz: pega insumo, passa por etapas, sai produto. Seis
+-- tabelas do V1 descrevem isso e nenhuma tinha destino.
+--
+--     production_orders           3   a ordem: o que produzir, quanto, quando
+--     production_order_inputs    27   o insumo consumido
+--     production_order_outputs    2   o que saiu
+--     production_order_steps      7   a etapa, na esta\xE7\xE3o, com tempo
+--     production_plan_items       2   o plano do dia, antes de virar ordem
+--     production_stations         4   onde a etapa acontece
+--
+-- O volume \xE9 rid\xEDculo \u2014 45 linhas \u2014 e \xE9 exatamente por isso que vale trazer: a
+-- casa est\xE1 COME\xC7ANDO a usar produ\xE7\xE3o, e o dia em que ela usar de verdade o
+-- hist\xF3rico j\xE1 vai estar do lado certo. Reconstituir depois \xE9 imposs\xEDvel: uma
+-- ordem de produ\xE7\xE3o fechada diz quanto de insumo virou quanto de produto, e
+-- esse n\xFAmero n\xE3o se recalcula.
+--
+-- \u2500\u2500 A receita j\xE1 existe, a ordem n\xE3o existia \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plg_inventory_recipes\`, \`_recipe_ingredients\` e \`_recipe_groups\` j\xE1 est\xE3o no
+-- V2: \xE9 a FICHA, o que a coisa leva. O que faltava \xE9 a EXECU\xC7\xC3O da ficha \u2014 a
+-- ordem que a aplica num dia, com o que realmente entrou e o que realmente
+-- saiu. \`recipe_snapshot\` guarda a ficha como ela era no dia, porque mudar a
+-- receita amanh\xE3 n\xE3o pode reescrever a produ\xE7\xE3o de ontem.
+--
+-- \u2500\u2500 A esta\xE7\xE3o \xE9 do KDS tamb\xE9m \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`production_stations\` do V1 carrega sete colunas de KDS (\`kds_enabled\`,
+-- \`kds_role\`, \`kds_sla_minutes\`\u2026). O V2 j\xE1 tem \`plg_kds_stations\` para isso, e
+-- duplicar a configura\xE7\xE3o do monitor aqui daria duas respostas para "qual a SLA
+-- desta esta\xE7\xE3o". Ent\xE3o elas v\xE3o para \`metadata.kds\`, de onde o dia da migra\xE7\xE3o
+-- do KDS as l\xEA \u2014 e a esta\xE7\xE3o de PRODU\xC7\xC3O fica com o que \xE9 dela: nome, unidade,
+-- se est\xE1 ativa.
+--
+-- Idempotente.
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_stations (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    name text NOT NULL,
+    description text,
+    is_active boolean DEFAULT true NOT NULL,
+    sort_order integer DEFAULT 0 NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_inventory_production_stations IS
+  'Onde a etapa de produ\xE7\xE3o acontece. V1: production_stations \u2014 a configura\xE7\xE3o de KDS dela fica em metadata.kds, porque plg_kds_stations \xE9 quem responde por monitor.';
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_orders (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    order_number text,
+    status text DEFAULT 'draft'::text NOT NULL,
+    product_id uuid,
+    recipe_id uuid,
+    -- A ficha como ela era no dia. Mudar a receita amanh\xE3 n\xE3o reescreve a
+    -- produ\xE7\xE3o de ontem.
+    recipe_snapshot jsonb,
+    planned_quantity numeric(18,4),
+    measurement_unit_id uuid,
+    planned_start timestamp with time zone,
+    planned_end timestamp with time zone,
+    actual_start timestamp with time zone,
+    actual_end timestamp with time zone,
+    source_type text,
+    priority integer DEFAULT 0 NOT NULL,
+    notes text,
+    owner_id uuid,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_inventory_production_orders_window_check
+      CHECK (actual_start IS NULL OR actual_end IS NULL OR actual_end >= actual_start)
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_steps (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    production_order_id uuid NOT NULL,
+    station_id uuid,
+    sequence integer DEFAULT 0 NOT NULL,
+    name text,
+    instructions text,
+    estimated_minutes integer,
+    status text DEFAULT 'pending'::text NOT NULL,
+    started_at timestamp with time zone,
+    completed_at timestamp with time zone,
+    -- O V1 guarda o nome do operador em texto, sem FK. Fica texto: inventar uma
+    -- pessoa a partir de um nome digitado \xE9 como se cria cadastro duplicado.
+    operator_name text,
+    notes text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_inputs (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    production_order_id uuid NOT NULL,
+    step_id uuid,
+    product_id uuid NOT NULL,
+    -- Planejado contra real: \xE9 a diferen\xE7a entre os dois que diz se a ficha
+    -- est\xE1 certa. Guardar s\xF3 o real perderia a pergunta.
+    planned_quantity numeric(18,4),
+    actual_quantity numeric(18,4),
+    measurement_unit_id uuid,
+    stock_position_id uuid,
+    unit_cost numeric(18,6),
+    consumed_at timestamp with time zone,
+    operator_name text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_outputs (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    production_order_id uuid NOT NULL,
+    product_id uuid NOT NULL,
+    -- Principal, subproduto ou perda. \xC9 a palavra que separa rendimento de
+    -- desperd\xEDcio, e sem ela a conta de custo n\xE3o fecha.
+    output_type text DEFAULT 'main'::text NOT NULL,
+    planned_quantity numeric(18,4),
+    actual_quantity numeric(18,4),
+    measurement_unit_id uuid,
+    batch_number text,
+    expiration_date date,
+    stock_position_id uuid,
+    unit_cost numeric(18,6),
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_inventory_production_plan_items (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    plan_date date NOT NULL,
+    product_id uuid NOT NULL,
+    planned_quantity numeric(18,4),
+    measurement_unit_id uuid,
+    status text DEFAULT 'planned'::text NOT NULL,
+    -- A ordem que o plano virou, quando virou. Nulo \xE9 plano ainda n\xE3o liberado.
+    production_order_id uuid,
+    notes text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_inventory_production_plan_items IS
+  'O que se pretende produzir naquele dia, antes de virar ordem. V1: production_plan_items.';
+
+-- \u2500\u2500 chaves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_inventory_production_stations', 'plg_inventory_production_orders',
+                           'plg_inventory_production_steps', 'plg_inventory_production_inputs',
+                           'plg_inventory_production_outputs', 'plg_inventory_production_plan_items'] LOOP
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = ('public.' || t)::regclass AND contype = 'p') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I PRIMARY KEY (id)', t, t || '_pkey');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_id_id_key') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I UNIQUE (tenant_id, id)', t, t || '_tenant_id_id_key');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_fkey') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE', t, t || '_tenant_fkey');
+    END IF;
+  END LOOP;
+END $$;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_stations_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_stations ADD CONSTRAINT plg_inventory_production_stations_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_orders_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_orders ADD CONSTRAINT plg_inventory_production_orders_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_orders_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_orders ADD CONSTRAINT plg_inventory_production_orders_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_orders_recipe_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_orders ADD CONSTRAINT plg_inventory_production_orders_recipe_fkey
+      FOREIGN KEY (recipe_id) REFERENCES public.plg_inventory_recipes(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_orders_uom_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_orders ADD CONSTRAINT plg_inventory_production_orders_uom_fkey
+      FOREIGN KEY (measurement_unit_id) REFERENCES public.plg_inventory_measurement_units(id) ON DELETE SET NULL;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_steps_order_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_steps ADD CONSTRAINT plg_inventory_production_steps_order_fkey
+      FOREIGN KEY (tenant_id, production_order_id) REFERENCES public.plg_inventory_production_orders(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_steps_station_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_steps ADD CONSTRAINT plg_inventory_production_steps_station_fkey
+      FOREIGN KEY (station_id) REFERENCES public.plg_inventory_production_stations(id) ON DELETE SET NULL;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_inputs_order_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_inputs ADD CONSTRAINT plg_inventory_production_inputs_order_fkey
+      FOREIGN KEY (tenant_id, production_order_id) REFERENCES public.plg_inventory_production_orders(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_inputs_step_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_inputs ADD CONSTRAINT plg_inventory_production_inputs_step_fkey
+      FOREIGN KEY (step_id) REFERENCES public.plg_inventory_production_steps(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_inputs_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_inputs ADD CONSTRAINT plg_inventory_production_inputs_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_inputs_uom_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_inputs ADD CONSTRAINT plg_inventory_production_inputs_uom_fkey
+      FOREIGN KEY (measurement_unit_id) REFERENCES public.plg_inventory_measurement_units(id) ON DELETE SET NULL;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_outputs_order_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_outputs ADD CONSTRAINT plg_inventory_production_outputs_order_fkey
+      FOREIGN KEY (tenant_id, production_order_id) REFERENCES public.plg_inventory_production_orders(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_outputs_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_outputs ADD CONSTRAINT plg_inventory_production_outputs_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_outputs_uom_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_outputs ADD CONSTRAINT plg_inventory_production_outputs_uom_fkey
+      FOREIGN KEY (measurement_unit_id) REFERENCES public.plg_inventory_measurement_units(id) ON DELETE SET NULL;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_plan_items_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_plan_items ADD CONSTRAINT plg_inventory_production_plan_items_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_plan_items_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_plan_items ADD CONSTRAINT plg_inventory_production_plan_items_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_production_plan_items_order_fkey') THEN
+    ALTER TABLE ONLY public.plg_inventory_production_plan_items ADD CONSTRAINT plg_inventory_production_plan_items_order_fkey
+      FOREIGN KEY (production_order_id) REFERENCES public.plg_inventory_production_orders(id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS plg_inventory_production_orders_number_uidx
+  ON public.plg_inventory_production_orders USING btree (tenant_id, order_number)
+  WHERE order_number IS NOT NULL;
+CREATE INDEX IF NOT EXISTS plg_inventory_production_orders_open_idx
+  ON public.plg_inventory_production_orders USING btree (tenant_id, unit_id, status, planned_start);
+CREATE INDEX IF NOT EXISTS plg_inventory_production_steps_order_idx
+  ON public.plg_inventory_production_steps USING btree (tenant_id, production_order_id, sequence);
+CREATE INDEX IF NOT EXISTS plg_inventory_production_inputs_order_idx
+  ON public.plg_inventory_production_inputs USING btree (tenant_id, production_order_id);
+CREATE INDEX IF NOT EXISTS plg_inventory_production_inputs_product_idx
+  ON public.plg_inventory_production_inputs USING btree (tenant_id, product_id, consumed_at DESC);
+CREATE INDEX IF NOT EXISTS plg_inventory_production_outputs_order_idx
+  ON public.plg_inventory_production_outputs USING btree (tenant_id, production_order_id);
+CREATE INDEX IF NOT EXISTS plg_inventory_production_plan_items_day_idx
+  ON public.plg_inventory_production_plan_items USING btree (tenant_id, unit_id, plan_date);
+CREATE UNIQUE INDEX IF NOT EXISTS plg_inventory_production_stations_name_uidx
+  ON public.plg_inventory_production_stations USING btree (tenant_id, unit_id, lower(name))
+  WHERE unit_id IS NOT NULL;
+
+-- RLS, uma a uma e por extenso. O la\xE7o adiante j\xE1 liga tudo isto \u2014 mas ele liga
+-- por \`EXECUTE format(...)\`, e o port\xE3o que revisa plugin l\xEA o ARQUIVO, n\xE3o o
+-- banco: para ele, tabela com tenant_id e sem um ENABLE literal \xE9 tabela
+-- aberta. Uma garantia que o revisor n\xE3o consegue ler \xE9 uma garantia que
+-- ningu\xE9m confere.
+ALTER TABLE public.plg_inventory_production_stations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_inventory_production_orders ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_inventory_production_steps ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_inventory_production_inputs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_inventory_production_outputs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_inventory_production_plan_items ENABLE ROW LEVEL SECURITY;
+
+DO $$
+DECLARE t text;
+DECLARE tem_unidade boolean;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_inventory_production_stations', 'plg_inventory_production_orders',
+                           'plg_inventory_production_steps', 'plg_inventory_production_inputs',
+                           'plg_inventory_production_outputs', 'plg_inventory_production_plan_items'] LOOP
+    tem_unidade := t IN ('plg_inventory_production_stations', 'plg_inventory_production_orders',
+                         'plg_inventory_production_plan_items');
+    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', t || '_updated_at', t);
+    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()', t || '_updated_at', t);
+    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', t);
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO authenticated', t);
+    EXECUTE format('GRANT ALL ON TABLE public.%I TO service_role', t);
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_select', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('inventory.read', %s)))$f$,
+      t || '_authz_select', t,
+      CASE WHEN tem_unidade THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN tem_unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_write', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR ALL TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (SELECT app.has_permission('inventory.edit', %s)))
+      WITH CHECK (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (SELECT app.has_permission('inventory.edit', %s)))$f$,
+      t || '_authz_write', t,
+      CASE WHEN tem_unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END,
+      CASE WHEN tem_unidade THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+  END LOOP;
+END $$;
+
+INSERT INTO public.scoped_resources (resource_table, unit_column, owner_column, shareable, default_visibility, label)
+VALUES ('plg_inventory_production_orders', 'unit_id', 'owner_id', false, 'unit', 'Ordens de produ\xE7\xE3o')
+ON CONFLICT (resource_table) DO UPDATE
+  SET unit_column = EXCLUDED.unit_column, default_visibility = EXCLUDED.default_visibility, label = EXCLUDED.label;
+`;
+var MIGRATION_007_A_PRODUCAO_ATRAVESSA = `-- A produ\xE7\xE3o atravessa.
+--
+-- A 006 fez as seis tabelas. Esta escreve o de-para com \`by_shape\` (spine 123).
+-- A ordem importa: esta\xE7\xE3o antes da etapa, ordem antes de tudo que pendura
+-- nela, e o plano por \xFAltimo porque ele aponta para a ordem que gerou.
+--
+-- \u2500\u2500 A configura\xE7\xE3o de KDS n\xE3o vem para c\xE1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`production_stations\` carrega sete colunas de KDS (\`kds_enabled\`, \`kds_role\`,
+-- \`kds_sla_minutes\`\u2026). Elas v\xE3o para \`metadata.kds\` e n\xE3o para coluna: o V2 tem
+-- \`plg_kds_stations\`, e duplicar a configura\xE7\xE3o do monitor aqui daria duas
+-- respostas para "qual a SLA desta esta\xE7\xE3o". Quando o KDS portar, ele l\xEA o
+-- metadata e a esta\xE7\xE3o de produ\xE7\xE3o fica com o que \xE9 dela.
+--
+-- \u2500\u2500 O movimento de estoque fica como refer\xEAncia \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`stock_movement_uuid\` no insumo e no produto aponta para a baixa/entrada que
+-- a produ\xE7\xE3o gerou. Vem como refer\xEAncia em metadata, n\xE3o como FK: o movimento
+-- atravessa por outro caminho (\`stock_movements\`) e amarrar os dois aqui
+-- exigiria que a ordem de produ\xE7\xE3o esperasse o raz\xE3o \u2014 uma depend\xEAncia que o
+-- volume (45 linhas) n\xE3o justifica.
+--
+-- Idempotente.
+
+SET LOCAL migration.allowlist_unlock = 'on';
+
+SELECT migration._allow(
+  'production_stations', 'public.plg_inventory_production_stations', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_stations'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                'id',
+    'name',                'name',
+    'description',         'description',
+    'active',              'is_active',
+    'kds_display_order',   'sort_order',
+    'created_at',          'created_at',
+    'updated_at',          'updated_at',
+    'tenant_id',           '-',
+    'unit_id',             '-',
+    'kds_enabled',         'jsonb:kds.enabled',
+    'kds_role',            'jsonb:kds.role',
+    'is_kds_fallback',     'jsonb:kds.is_fallback',
+    'kds_sla_minutes',     'jsonb:kds.sla_minutes',
+    'kds_catalog_mode',    'jsonb:kds.catalog_mode',
+    'kds_config_version',  'jsonb:kds.config_version',
+    'id',                  'jsonb:inventory.v1_ref'),
+  'Onde a etapa acontece. \`unit_id\` da origem \xE9 uuid de companies e n\xE3o o id '
+  'num\xE9rico que o ledger resolve \u2014 a unidade vem pelo augment do extrator. A '
+  'configura\xE7\xE3o de KDS fica em metadata.kds porque plg_kds_stations \xE9 quem '
+  'responde por monitor.'
+);
+
+SELECT migration._allow(
+  'production_orders', 'public.plg_inventory_production_orders', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_orders'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',             'id',
+    'unit_id',          'unit_id@companies',
+    'order_number',     'order_number',
+    'status',           'status',
+    'product_id',       'product_id@products',
+    'recipe_id',        'recipe_id@recipes',
+    'recipe_snapshot',  'recipe_snapshot',
+    'planned_qty',      'planned_quantity',
+    'unit_id_measure',  'measurement_unit_id@measurement_units',
+    'planned_start',    'planned_start',
+    'planned_end',      'planned_end',
+    'actual_start',     'actual_start',
+    'actual_end',       'actual_end',
+    'source_type',      'source_type',
+    'priority',         'priority',
+    'notes',            'notes',
+    'created_at',       'created_at',
+    'updated_at',       'updated_at',
+    'tenant_id',        '-',
+    'created_by',       '-',
+    'released_by',      '-',
+    'finished_by',      '-',
+    'id',               'jsonb:inventory.v1_ref'),
+  'A ordem de produ\xE7\xE3o. \`recipe_snapshot\` \xE9 a ficha como ela era no dia \u2014 '
+  'mudar a receita amanh\xE3 n\xE3o pode reescrever a produ\xE7\xE3o de ontem.'
+);
+
+SELECT migration._allow(
+  'production_order_steps', 'public.plg_inventory_production_steps', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_steps'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                   'id',
+    'order_id',               'production_order_id@production_orders',
+    'production_station_id',  'station_id@production_stations',
+    'sequence',               'sequence',
+    'name',                   'name',
+    'instructions',           'instructions',
+    'estimated_minutes',      'estimated_minutes',
+    'status',                 'status',
+    'started_at',             'started_at',
+    'completed_at',           'completed_at',
+    'operator_name',          'operator_name',
+    'notes',                  'notes',
+    'created_at',             'created_at',
+    'updated_at',             'updated_at',
+    'tenant_id',              '-',
+    'id',                     'jsonb:inventory.v1_ref'),
+  'A etapa, na esta\xE7\xE3o, com tempo. \`operator_name\` continua texto: inventar uma '
+  'pessoa a partir de um nome digitado \xE9 como se cria cadastro duplicado.'
+);
+
+SELECT migration._allow(
+  'production_order_inputs', 'public.plg_inventory_production_inputs', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_inputs'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                 'id',
+    'order_id',             'production_order_id@production_orders',
+    'step_id',              'step_id@production_order_steps',
+    'product_id',           'product_id@products',
+    'planned_qty',          'planned_quantity',
+    'actual_qty',           'actual_quantity',
+    'unit_id',              'measurement_unit_id@measurement_units',
+    'stock_position_id',    'stock_position_id@stock_positions',
+    'unit_cost',            'unit_cost',
+    'consumed_at',          'consumed_at',
+    'operator_name',        'operator_name',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'product_uuid',         '-',
+    'unit_label_id',        '-',
+    'stock_movement_uuid',  'jsonb:inventory.v1_stock_movement_ref',
+    'id',                   'jsonb:inventory.v1_ref'),
+  'O insumo consumido. Planejado E real: \xE9 a diferen\xE7a entre os dois que diz se '
+  'a ficha est\xE1 certa. \`unit_id\` aqui \xE9 UNIDADE DE MEDIDA, n\xE3o filial \u2014 o nome '
+  'da coluna do V1 engana, e por isso o destino se chama measurement_unit_id.'
+);
+
+SELECT migration._allow(
+  'production_order_outputs', 'public.plg_inventory_production_outputs', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_outputs'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                 'id',
+    'order_id',             'production_order_id@production_orders',
+    'product_id',           'product_id@products',
+    'output_type',          'output_type',
+    'planned_qty',          'planned_quantity',
+    'actual_qty',           'actual_quantity',
+    'unit_id',              'measurement_unit_id@measurement_units',
+    'batch_number',         'batch_number',
+    'expiration_date',      'expiration_date',
+    'stock_position_id',    'stock_position_id@stock_positions',
+    'unit_cost',            'unit_cost',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'product_uuid',         '-',
+    'stock_movement_uuid',  'jsonb:inventory.v1_stock_movement_ref',
+    'id',                   'jsonb:inventory.v1_ref'),
+  'O que saiu: principal, subproduto ou perda. \xC9 essa palavra que separa '
+  'rendimento de desperd\xEDcio, e sem ela a conta de custo n\xE3o fecha.'
+);
+
+SELECT migration._allow(
+  'production_plan_items', 'public.plg_inventory_production_plan_items', 'inventory', 'by_shape',
+  jsonb_build_object('target', 'public.plg_inventory_production_plan_items'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                 'id',
+    'unit_id',              'unit_id@companies',
+    'plan_date',            'plan_date',
+    'product_id',           'product_id@products',
+    'planned_qty',          'planned_quantity',
+    'unit_id_measure',      'measurement_unit_id@measurement_units',
+    'status',               'status',
+    'production_order_id',  'production_order_id@production_orders',
+    'notes',                'notes',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'id',                   'jsonb:inventory.v1_ref'),
+  'O que se pretende produzir naquele dia, antes de virar ordem. Vem por \xFAltimo '
+  'porque aponta para a ordem que ele gerou.'
+);
+
+DELETE FROM migration.excluded_tables
+ WHERE source_table IN ('production_stations', 'production_orders', 'production_order_steps',
+                        'production_order_inputs', 'production_order_outputs', 'production_plan_items');
+
+RESET migration.allowlist_unlock;
+`;
+var MIGRATION_008_O_GRUPO_DA_RECEITA_TAMBEM_E_DE_UMA_CASA = `-- O grupo da receita tamb\xE9m \xE9 de uma casa.
+--
+-- \`plg_inventory_recipes\` e \`plg_inventory_recipe_ingredients\` j\xE1 carregam
+-- \`unit_id\`. \`plg_inventory_recipe_groups\` \u2014 que \xE9 irm\xE3o dos dois e agrupa
+-- ingredientes alternativos dentro da mesma ficha \u2014 ficou sem.
+--
+-- S\xE3o 172 grupos no Pertinho do C\xE9u. Sem a coluna, o grupo de uma cozinha
+-- aparece na ficha da outra, e a substitui\xE7\xE3o de ingrediente sugere um produto
+-- que aquela casa n\xE3o tem em estoque.
+--
+-- Idempotente.
+
+ALTER TABLE public.plg_inventory_recipe_groups ADD COLUMN IF NOT EXISTS unit_id uuid;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_inventory_recipe_groups_unit_fkey') THEN
+    ALTER TABLE public.plg_inventory_recipe_groups ADD CONSTRAINT plg_inventory_recipe_groups_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+COMMENT ON COLUMN public.plg_inventory_recipe_groups.unit_id IS
+  'A cozinha a que o grupo pertence \u2014 as irm\xE3s plg_inventory_recipes e _recipe_ingredients j\xE1 a tinham (008).';
+
+CREATE INDEX IF NOT EXISTS plg_inventory_recipe_groups_unit_idx
+  ON public.plg_inventory_recipe_groups USING btree (tenant_id, unit_id);
+`;
+var MIGRATION_009_A_DIRECAO_DO_MOVIMENTO_NAO_ESTA_NO_NUMERO = `-- A dire\xE7\xE3o do movimento n\xE3o est\xE1 no n\xFAmero \u2014 e o V2 guarda ela l\xE1.
+--
+-- \`plg_inventory_stock_movements\` assina a quantidade. O CHECK diz isso em voz
+-- alta desde o baseline:
+--
+--     plg_inventory_stock_movements_sign_check
+--       (kind = 'in'       AND quantity > 0)
+--    OR (kind = 'out'      AND quantity < 0)
+--    OR (kind = 'transfer' AND quantity < 0)
+--    OR  kind IN ('adjust', 'reverse')
+--
+-- E n\xE3o \xE9 decora\xE7\xE3o: \`app.inventory_movements_after_insert\` soma \`NEW.quantity\`
+-- na posi\xE7\xE3o de origem e \`-NEW.quantity\` na de destino. O sinal \xC9 o efeito no
+-- saldo. Uma sa\xEDda positiva n\xE3o seria recusada por capricho \u2014 ela AUMENTARIA o
+-- estoque.
+--
+-- O V1 guarda a dire\xE7\xE3o em outro lugar: no \`movement_type\`. O n\xFAmero \xE9 sempre a
+-- magnitude. Medido em 21/09/2026 sobre os 2.997 movimentos do banco inteiro,
+-- todos os inquilinos:
+--
+--     entrada         2.871   menor 0,001   maior 10.000   negativos: 0
+--     saida             119   menor 0,2     maior     26   negativos: 0
+--     ajuste              6   menor 1       maior      1   negativos: 0
+--     transferencia       1   menor 1       maior      1   negativos: 0
+--
+-- \`migration.upsert_inv_movement\` traduzia o R\xD3TULO (\`saida\` \u2192 \`out\`) e passava
+-- o n\xFAmero adiante intacto. Ou seja: toda sa\xEDda e toda transfer\xEAncia do V1 era
+-- uma viola\xE7\xE3o de constraint garantida. Isso ficou dois inquilinos sem
+-- aparecer porque o Pertinho do C\xE9u s\xF3 tem entrada \u2014 2.707 de 2.707. O Espa\xE7o
+-- Facial \xE9 o primeiro com sa\xEDda, e as tr\xEAs sa\xEDdas dele que tinham local
+-- bateram na constraint:
+--
+--     state: 23514: ... violates check constraint
+--            "plg_inventory_stock_movements_sign_check"   \xD73
+--
+-- \u2500\u2500 O ajuste \xE9 o caso que n\xE3o se resolve pelo r\xF3tulo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`entrada\`, \`saida\` e \`transferencia\` dizem a dire\xE7\xE3o no nome. \`ajuste\` n\xE3o:
+-- ele tanto acha quanto perde, e o V1 escreve 1 nos dois casos. Quem sabe \xE9 a
+-- contagem que o gerou \u2014 \`stock_count_items.counted_qty - system_qty_at_review\`
+-- \xE9 a diferen\xE7a apurada, com sinal. Conferido nos 4 ajustes de invent\xE1rio do
+-- Espa\xE7o Facial: os dois "falta apurada" d\xE3o -1, os dois "sobra apurada" d\xE3o
+-- +1. O extrator passou a mandar isso como \`adjust_delta\` (ver
+-- fayz-etl/fayz_etl/sources/beautysoft_v1.py, passo \`stock_movements\`), e o
+-- de-para abaixo abre a porta para a coluna.
+--
+-- Quando o ajuste n\xE3o vem de contagem, \`adjust_delta\` chega nulo \u2014 e a\xED a
+-- linha vai para a quarentena em vez de entrar com o sinal chutado. S\xE3o 2
+-- linhas hoje ("Corre\xE7\xE3o de auditoria (estorno)"), e as duas j\xE1 estavam
+-- paradas por falta de local. Somar onde era para subtrair \xE9 o erro que
+-- ningu\xE9m v\xEA: ele n\xE3o quebra nada, s\xF3 deixa o saldo errado.
+--
+-- \u2500\u2500 O que N\xC3O muda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A guarda de entrada continua exigindo \`quantity > 0\`: o writer recebe do V1,
+-- e no V1 a dire\xE7\xE3o \xE9 o tipo, n\xE3o o sinal. O que muda \xE9 a SA\xCDDA dele \u2014 a
+-- tradu\xE7\xE3o para a conven\xE7\xE3o da tabela de destino, que \xE9 onde ela sempre
+-- deveria ter acontecido. As 2.208 + 47 entradas j\xE1 migradas n\xE3o se movem: para
+-- \`in\`, assinado e magnitude s\xE3o o mesmo n\xFAmero, e a tabela \xE9 append-only.
+--
+-- Idempotente: CREATE OR REPLACE e um UPDATE de jsonb por concatena\xE7\xE3o.
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 1. O writer assina o n\xFAmero
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE OR REPLACE FUNCTION migration.upsert_inv_movement(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_kind_raw text := nullif(btrim(lower(coalesce(p_row ->> 'kind', ''))), '');
+  v_kind text := CASE v_kind_raw
+                   WHEN 'in' THEN 'in' WHEN 'out' THEN 'out'
+                   WHEN 'transfer' THEN 'transfer' WHEN 'adjust' THEN 'adjust' WHEN 'reverse' THEN 'reverse'
+                   -- the SDK's legacy labels, and V1's pt-BR
+                   WHEN 'entry' THEN 'in' WHEN 'entrada' THEN 'in'
+                   WHEN 'exit' THEN 'out' WHEN 'saida' THEN 'out' WHEN 'sa\xEDda' THEN 'out'
+                   WHEN 'loss' THEN 'out' WHEN 'perda' THEN 'out'
+                   WHEN 'adjustment' THEN 'adjust' WHEN 'ajuste' THEN 'adjust'
+                   WHEN 'transferencia' THEN 'transfer' WHEN 'transfer\xEAncia' THEN 'transfer'
+                 END;
+  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  -- A magnitude, como a origem a manda, e o n\xFAmero ASSINADO que a tabela pede.
+  -- Os dois existem porque s\xE3o contratos de lados diferentes da fronteira.
+  v_qty numeric := coalesce((p_row ->> 'quantity')::numeric, 0);
+  v_delta numeric := (p_row ->> 'adjust_delta')::numeric;
+  v_signed numeric;
+  v_exists boolean;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR (p_row ->> 'product_id') IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk', 'reason', 'a stock movement needs an id and its product');
+  END IF;
+  IF v_kind IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('unknown movement type %L (expected in|out|transfer|adjust|reverse, or a V1 label of one)', coalesce(v_kind_raw, '<null>')));
+  END IF;
+  IF v_qty <= 0 THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value', 'reason', 'a stock movement needs a quantity > 0 \u2014 direction is the kind, not the sign');
+  END IF;
+  IF v_kind = 'transfer' AND (p_row ->> 'destination_location_id') IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a transfer needs its destination location');
+  END IF;
+
+  -- A tradu\xE7\xE3o. O r\xF3tulo diz a dire\xE7\xE3o em tr\xEAs dos cinco tipos; no ajuste ela
+  -- vem da contagem, e sem ela n\xE3o se inventa.
+  IF v_kind = 'adjust' THEN
+    IF v_delta IS NULL OR v_delta = 0 THEN
+      RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+        'reason', 'an adjustment does not say which way it goes \u2014 the V1 writes the size and leaves the sign to the count it came from (adjust_delta)');
+    END IF;
+    v_signed := sign(v_delta) * v_qty;
+  ELSIF v_kind IN ('out', 'transfer') THEN
+    v_signed := -v_qty;
+  ELSE
+    -- 'in' e 'reverse'. O estorno mant\xE9m a magnitude: o sign_check o dispensa,
+    -- e quem decide o sentido dele \xE9 o movimento que ele desfaz.
+    v_signed := v_qty;
+  END IF;
+
+  SELECT EXISTS (SELECT 1 FROM public.plg_inventory_stock_movements WHERE id = p_id) INTO v_exists;
+  IF v_exists THEN
+    -- the ledger is append-only: a second offer of the same movement is a replay,
+    -- not an update. Nothing to do, and saying "migrated" again is honest \u2014
+    -- the destination already holds exactly this row.
+    RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', 'already in the ledger (append-only)');
+  END IF;
+
+  -- 005's single-writer gate refuses any write "however privileged" unless this
+  -- is set. The migration IS one of the internal writers \u2014 definer-only, fenced
+  -- and audited \u2014 so it declares itself rather than being exempted, and the
+  -- after-insert trigger derives the position from what it writes.
+  PERFORM set_config('fayz.inventory_internal', 'on', true);
+  INSERT INTO public.plg_inventory_stock_movements
+    (id, tenant_id, product_id, kind, quantity, unit_cost, total_cost,
+     source_location_id, destination_location_id, batch_number, expiration_date,
+     document_number, reason, notes, movement_date, metadata)
+  VALUES (p_id, p_tenant, (p_row ->> 'product_id')::uuid, v_kind,
+          v_signed,
+          (p_row ->> 'unit_cost')::numeric, (p_row ->> 'total_cost')::numeric,
+          (p_row ->> 'source_location_id')::uuid, (p_row ->> 'destination_location_id')::uuid,
+          p_row ->> 'batch_number', (p_row ->> 'expiration_date')::date,
+          p_row ->> 'document_number', p_row ->> 'reason', p_row ->> 'notes',
+          coalesce((p_row ->> 'movement_date')::timestamptz, now()), v_meta);
+  PERFORM set_config('fayz.inventory_internal', 'off', true);
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_inventory_stock_movements', p_id, jsonb_build_object('reason', 'created')); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', 'created');
+END $function$;
+
+COMMENT ON FUNCTION migration.upsert_inv_movement(uuid, uuid, jsonb, jsonb) IS
+  'Movimento de estoque do V1 para o V2. Recebe magnitude + tipo (a conven\xE7\xE3o do V1) e grava quantidade ASSINADA (a conven\xE7\xE3o da tabela). A dire\xE7\xE3o do ajuste vem de adjust_delta \u2014 ver 009.';
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 2. O de-para abre a porta para a dire\xE7\xE3o do ajuste
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`adjust_delta\` n\xE3o \xE9 coluna do V1: \xE9 derivada pelo plano de leitura, a partir
+-- de \`stock_count_items\`. Entra no mapa como campo simples porque \xE9 isso que
+-- ela \xE9 no \`p_row\` \u2014 o writer l\xEA e n\xE3o grava, ent\xE3o ela n\xE3o precisa (nem pode)
+-- casar com coluna do destino.
+
+SET LOCAL migration.allowlist_unlock = 'on';
+
+UPDATE migration.allowlist
+   SET columns = columns || jsonb_build_object('adjust_delta', 'adjust_delta')
+ WHERE source_table = 'stock_movements';
+
+RESET migration.allowlist_unlock;
+`;
+var MIGRATION_010_A_ENTRADA_DE_NOTAS_ATRAVESSA = `-- A entrada de notas atravessa.
+--
+-- A importa\xE7\xE3o de DANFE do V1 \u2014 607 notas (527 no Pertinho do C\xE9u, 80 no
+-- Espa\xE7o Facial), 3.008 linhas, 68 lotes \u2014 n\xE3o tinha nenhuma linha na
+-- \`migration.allowlist\`. Este arquivo escreve a dela e a das linhas; a parcela,
+-- que \xE9 do financeiro, mora em plugin-financial/084 (o financeiro roda ANTES do
+-- invent\xE1rio na corrente, ent\xE3o o de-para dela n\xE3o podia vir por aqui).
+--
+-- \u2500\u2500 O achado que mudou o desenho: a linha da nota J\xC1 \xE9 o movimento \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O caminho \xF3bvio seria \`danfe_import_items\` \u2192 \`plg_inventory_stock_movements\`.
+-- Medido em 21/09/2026 no V1 de produ\xE7\xE3o, ele DOBRARIA o estoque:
+--
+--   tenant 8: 2.707 dos 2.860 itens (94,7%) j\xE1 t\xEAm um \`stock_movements\` no V1,
+--             e a tabela \`stock_movements\` do tenant 8 \xE9 INTEIRA de DANFE \u2014
+--             2.707 de 2.707 linhas com \`danfe_import_item_id\`.
+--   ledger:   2.757 movimentos j\xE1 atravessaram (\`status = 'migrated'\`).
+--
+-- Quantidade e custo batem linha a linha (o movimento \xE9 gerado pela concilia\xE7\xE3o
+-- da nota). Criar um segundo movimento a partir do item somaria a mesma entrada
+-- duas vezes \u2014 e, pior, o gatilho \`plg_inventory_stock_movements_after_insert\`
+-- deriva a POSI\xC7\xC3O do movimento, ent\xE3o o saldo dobraria junto, sem ningu\xE9m
+-- acusar.
+--
+-- Ent\xE3o a linha da nota n\xE3o cria movimento: ela ADOTA o que j\xE1 atravessou.
+-- \`movement_uuid\` resolve pelo ledger de \`stock_movements\`, o writer devolve
+-- aquele id como \`target_id\`, e o conte\xFAdo da linha \u2014 o que o movimento n\xE3o
+-- carrega: NCM, CFOP, tributo, fator de convers\xE3o, produto sugerido pela IA \u2014
+-- vai para o \`result\` da opera\xE7\xE3o, que \xE9 onde o V2 j\xE1 guarda o que uma opera\xE7\xE3o
+-- de invent\xE1rio produziu (\`app.inventory_movement_json\`, \`inventory_receive\`).
+--
+-- Item sem movimento no V1 (153 no tenant 8, 114 no tenant 1) \xE9 linha que nunca
+-- virou estoque: entra no \`result\` e fica \`skipped\`. O porte n\xE3o inventa
+-- entrada que a origem n\xE3o fez.
+--
+-- \u2500\u2500 E o conte\xFAdo FISCAL da nota tamb\xE9m j\xE1 atravessa \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 607 de 607 notas t\xEAm a contraparte em \`dfe_inbox\` pela chave de acesso, e as
+-- 607 t\xEAm o MESMO n\xFAmero de linhas em \`dfe_inbox_items\` (149 = 149 no tenant 1,
+-- 2.859 = 2.859 no tenant 8). O XML, o tributo por coluna e a duplicata j\xE1 v\xE3o
+-- para \`plg_fiscalbr_inbox_*\` por fiscal_br/003. Copiar tudo de novo aqui daria
+-- duas respostas para "qual o ICMS desta linha".
+--
+-- O que N\xC3O atravessava \xE9 a DECIS\xC3O DE ENTRADA feita sobre a nota: a qual
+-- produto a linha foi ligada, em que unidade de estoque, com que fator de
+-- convers\xE3o, em que conta cont\xE1bil, e o plano de pagamento que o operador
+-- montou. \xC9 isso que este arquivo traz.
+--
+-- \u2500\u2500 A nota \xE9 uma opera\xE7\xE3o de recebimento \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plg_inventory_operations\` \xE9 o raz\xE3o de opera\xE7\xF5es do invent\xE1rio, com
+-- vocabul\xE1rio fechado (\`receive | transfer | adjust | reserve | confirm |
+-- reverse\`). Uma importa\xE7\xE3o de DANFE \xE9 um \`receive\`, e a \`idempotency_key\` dela
+-- \xE9 a CHAVE DE ACESSO: 607 de 607 notas t\xEAm chave, e ela \xE9 \xFAnica dentro do
+-- tenant nas duas casas. Isso faz o \`op.idempotency_key = doc.access_key\`
+-- ligar a opera\xE7\xE3o ao documento fiscal sem coluna nova e sem FK entre plugins
+-- (o fiscal_br roda DEPOIS do invent\xE1rio).
+--
+-- \u2500\u2500 A coluna que eu tive de criar \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plg_inventory_operations\` n\xE3o tinha \`metadata\`. Sem ela o \`by_shape\` joga
+-- fora EM SIL\xCANCIO tudo que n\xE3o casa com uma coluna do destino \u2014 que aqui s\xE3o
+-- os 20 campos da nota \u2014 e joga fora tamb\xE9m a proveni\xEAncia que
+-- \`_upsert_row_impl\` carimba em toda linha portada (\`migration.source_table\`,
+-- \`source_numeric_id\`, \`batch_id\`). Seriam 607 notas no V2 sem como dizer de
+-- onde vieram. \xC9 a \xFAnica coluna nova deste arquivo.
+--
+-- Idempotente.
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 1. A opera\xE7\xE3o ganha onde guardar a nota
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_inventory_operations
+  ADD COLUMN IF NOT EXISTS metadata jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+COMMENT ON COLUMN public.plg_inventory_operations.metadata IS
+  'O que a opera\xE7\xE3o carrega e nenhuma coluna nomeia. No porte \xE9 a nota de '
+  'entrada inteira (metadata.danfe) e a proveni\xEAncia da linha (metadata.migration). '
+  'A identidade da nota fica em idempotency_key, que \xE9 a chave de acesso.';
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 2. O writer gen\xE9rico com a porteira do invent\xE1rio aberta
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`migration.upsert_by_shape\` (spine 123/124) resolve o upsert desta tabela
+-- sozinho: as colunas do destino j\xE1 t\xEAm o nome que o de-para produz. O que ele
+-- N\xC3O faz \xE9 abrir a porteira \`fayz.inventory_internal\`, e as tr\xEAs tabelas de
+-- invent\xE1rio recusam qualquer escrita sem ela \u2014 inclusive a do porte, que \xE9
+-- definer e cercada:
+--
+--   inventory: plg_inventory_operations is written only through the inventory RPCs
+--
+-- Foi essa frase que p\xF4s 339 posi\xE7\xF5es em quarentena na 004 e que a 005 acabou
+-- dando por certa. Ela continua certa para a POSI\xC7\xC3O \u2014 a 005 tirou
+-- \`stock_positions\` da allowlist porque o saldo \xE9 consequ\xEAncia do movimento \u2014
+-- e n\xE3o diz nada contra a OPERA\xC7\xC3O, que \xE9 um fato do V1 e n\xE3o um derivado de
+-- nada. O que ela exige \xE9 que quem escreve se declare.
+--
+-- Em vez de copiar o by_shape inteiro s\xF3 para acrescentar duas linhas, este
+-- writer abre a porteira, delega, e fecha. A porteira \xE9 transacional
+-- (\`set_config(..., true)\`): ela morre com a transa\xE7\xE3o e n\xE3o vaza para a linha
+-- seguinte do lote.
+
+CREATE OR REPLACE FUNCTION migration.upsert_inv_shape(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_prev text := coalesce(current_setting('fayz.inventory_internal', true), 'off');
+  v_res  jsonb;
+BEGIN
+  PERFORM set_config('fayz.inventory_internal', 'on', true);
+  v_res := migration.upsert_by_shape(p_tenant, p_id, p_row, p_args);
+  PERFORM set_config('fayz.inventory_internal', v_prev, true);
+  RETURN v_res;
+END $function$;
+
+COMMENT ON FUNCTION migration.upsert_inv_shape(uuid, uuid, jsonb, jsonb) IS
+  'upsert_by_shape com fayz.inventory_internal ligado. Para a tabela de invent\xE1rio '
+  'que j\xE1 tem a forma certa e cuja porteira de escrita \xFAnica recusaria o porte.';
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 3. O writer da linha da nota \u2014 adota, nunca duplica
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Serve as duas partes da nota, escolhidas por \`writer_args.part\`:
+--
+--   'item'   a linha da nota \u2192 o MOVIMENTO que ela gerou no V1
+--   'batch'  o lote da linha \u2192 a POSI\xC7\xC3O que aquele movimento derivou
+--
+-- Nenhuma das duas insere: as duas devolvem o id do que j\xE1 est\xE1 l\xE1. \xC9 a \xFAnica
+-- forma de a linha atravessar sem somar estoque duas vezes, porque
+-- \`plg_inventory_stock_movements\` \xE9 append-only (o gatilho recusa at\xE9 um UPDATE
+-- que s\xF3 acrescente coluna nula) e a posi\xE7\xE3o \xE9 consequ\xEAncia do movimento.
+--
+-- O conte\xFAdo da linha vai para \`plg_inventory_operations.result\`, indexado pelo
+-- id da linha \u2014 objeto e n\xE3o lista, para a segunda oferta da mesma linha
+-- substituir a primeira em vez de empilhar.
+
+CREATE OR REPLACE FUNCTION migration.upsert_inv_danfe_line(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_part      text := coalesce(p_args ->> 'part', 'item');
+  v_meta      jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_operation uuid := (p_row ->> 'operation_id')::uuid;
+  v_movement  uuid := (p_row ->> 'movement_id')::uuid;
+  v_product   uuid := (p_row ->> 'product_id')::uuid;
+  v_location  uuid := (p_row ->> 'stock_location_id')::uuid;
+  v_target    uuid;
+  v_linha     jsonb;
+  v_prev      text;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+
+  IF p_id IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma linha de nota precisa de id');
+  END IF;
+  IF v_operation IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', 'linha de nota cuja importa\xE7\xE3o ainda n\xE3o atravessou');
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.plg_inventory_operations o
+                  WHERE o.id = v_operation AND o.tenant_id = p_tenant) THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('a opera\xE7\xE3o %s n\xE3o existe neste tenant', v_operation));
+  END IF;
+
+  -- O que atravessa da linha: tudo que o movimento n\xE3o nomeia. Fica no \`result\`
+  -- da opera\xE7\xE3o, que \xE9 onde o V2 guarda o que uma opera\xE7\xE3o produziu.
+  -- \`coalesce\` porque \`NULL || jsonb\` \xE9 NULL, e uma nota sem nenhum campo de
+  -- linha mapeado apagaria o registro inteiro em sil\xEAncio.
+  v_linha := jsonb_strip_nulls(
+    coalesce(v_meta -> 'danfe' -> CASE WHEN v_part = 'batch' THEN 'batch' ELSE 'line' END, '{}'::jsonb)
+    || jsonb_build_object(
+         'movement_id', to_jsonb(v_movement),
+         'product_id',  to_jsonb(v_product),
+         'line_no',     p_row -> 'line_no',
+         'quantity',    p_row -> 'quantity',
+         'batch_number', p_row -> 'batch_number',
+         'expiration_date', p_row -> 'expiration_date'));
+
+  IF v_part = 'batch' THEN
+    -- O lote n\xE3o cria posi\xE7\xE3o: ele aponta para a que o movimento derivou. A
+    -- chave da posi\xE7\xE3o \xE9 (tenant, produto, local, lote, validade) \u2014 a mesma que
+    -- \`app.inventory_apply_to_position\` usa para decidir se soma ou cria.
+    IF v_movement IS NOT NULL AND v_product IS NOT NULL AND v_location IS NOT NULL THEN
+      SELECT sp.id INTO v_target
+        FROM public.plg_inventory_stock_positions sp
+       WHERE sp.tenant_id = p_tenant
+         AND sp.product_id = v_product
+         AND sp.stock_location_id = v_location
+         AND sp.batch_number IS NOT DISTINCT FROM nullif(btrim(p_row ->> 'batch_number'), '')
+         AND sp.expiration_date IS NOT DISTINCT FROM (p_row ->> 'expiration_date')::date
+       LIMIT 1;
+    END IF;
+  ELSE
+    v_target := v_movement;
+  END IF;
+
+  -- A porteira do invent\xE1rio: a opera\xE7\xE3o recusa UPDATE sem ela, do porte
+  -- inclusive. Transacional, para n\xE3o vazar para a linha seguinte.
+  v_prev := coalesce(current_setting('fayz.inventory_internal', true), 'off');
+  PERFORM set_config('fayz.inventory_internal', 'on', true);
+  UPDATE public.plg_inventory_operations o
+     SET result = coalesce(o.result, '{}'::jsonb) || jsonb_build_object(
+                    CASE WHEN v_part = 'batch' THEN 'batches' ELSE 'lines' END,
+                    coalesce(o.result -> CASE WHEN v_part = 'batch' THEN 'batches' ELSE 'lines' END, '{}'::jsonb)
+                      || jsonb_build_object(p_id::text, v_linha))
+   WHERE o.id = v_operation AND o.tenant_id = p_tenant;
+  PERFORM set_config('fayz.inventory_internal', v_prev, true);
+
+  IF v_target IS NULL THEN
+    -- Linha declarada e nunca conciliada: no V1 ela n\xE3o virou estoque, e o
+    -- porte n\xE3o inventa a entrada que a origem n\xE3o fez. O conte\xFAdo dela j\xE1 foi
+    -- gravado no \`result\` acima \u2014 o que falta \xE9 s\xF3 o v\xEDnculo com o raz\xE3o.
+    RETURN jsonb_build_object('status', 'skipped',
+      'reason', CASE WHEN v_part = 'batch'
+                     THEN 'lote sem posi\xE7\xE3o no V2 \u2014 o movimento dele n\xE3o atravessou'
+                     ELSE 'linha sem movimento no V1 \u2014 nunca virou estoque' END);
+  END IF;
+
+  IF v_standalone THEN
+    PERFORM migration._audit(p_tenant,
+      CASE WHEN v_part = 'batch' THEN 'public.plg_inventory_stock_positions'
+           ELSE 'public.plg_inventory_stock_movements' END,
+      v_target, jsonb_build_object('reason', 'adopted'));
+  END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', v_target,
+    'reason', CASE WHEN v_part = 'batch'
+                   THEN 'a posi\xE7\xE3o deste lote j\xE1 \xE9 consequ\xEAncia do movimento'
+                   ELSE 'a linha \xE9 o movimento que j\xE1 atravessou' END);
+END $function$;
+
+COMMENT ON FUNCTION migration.upsert_inv_danfe_line(uuid, uuid, jsonb, jsonb) IS
+  'A linha (ou o lote) da nota de entrada. Adota o movimento/posi\xE7\xE3o que o V1 j\xE1 '
+  'gerou em vez de criar um segundo \u2014 94,7% das linhas do tenant 8 t\xEAm movimento, '
+  'e duplic\xE1-lo dobraria o estoque \u2014 e guarda o conte\xFAdo da linha em operations.result.';
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 4. O vocabul\xE1rio de writers aceita os nomes novos
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Lendo e costurando o CHECK que est\xE1 l\xE1, nunca reescrevendo com lista literal:
+-- a lista literal apaga as palavras que os outros passos da corrente
+-- acrescentaram, e o erro s\xF3 aparece na onda seguinte.
+
+DO $$
+DECLARE v_def text;
+BEGIN
+  SELECT pg_get_constraintdef(oid) INTO v_def
+    FROM pg_constraint WHERE conname = 'allowlist_writer_check';
+  IF v_def IS NULL OR strpos(v_def, 'inv_shape') > 0 THEN RETURN; END IF;
+  ALTER TABLE migration.allowlist DROP CONSTRAINT allowlist_writer_check;
+  EXECUTE replace(
+    'ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check ' || v_def,
+    '''person''::text', '''person''::text, ''inv_shape''::text');
+END $$;
+
+DO $$
+DECLARE v_def text;
+BEGIN
+  SELECT pg_get_constraintdef(oid) INTO v_def
+    FROM pg_constraint WHERE conname = 'allowlist_writer_check';
+  IF v_def IS NULL OR strpos(v_def, 'inv_danfe_line') > 0 THEN RETURN; END IF;
+  ALTER TABLE migration.allowlist DROP CONSTRAINT allowlist_writer_check;
+  EXECUTE replace(
+    'ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check ' || v_def,
+    '''person''::text', '''person''::text, ''inv_danfe_line''::text');
+END $$;
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- 5. O de-para
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A ordem \xE9 a da depend\xEAncia: a nota antes das linhas, as linhas antes dos
+-- lotes. As tr\xEAs resolvem \`import_id@danfe_imports\` pelo ledger, e o ledger s\xF3
+-- responde depois que a nota atravessou.
+
+SET LOCAL migration.allowlist_unlock = 'on';
+
+SELECT migration._allow(
+  'danfe_imports', 'public.plg_inventory_operations', 'inventory', 'inv_shape',
+  jsonb_build_object('target', 'public.plg_inventory_operations'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                     'id',
+    -- \`kind\` e \`op_status\` v\xEAm do augment do extrator: o V1 n\xE3o guarda a
+    -- palavra "receive" porque a tabela INTEIRA \xE9 de entrada, e o status dele
+    -- tem cinco palavras (pending | partial | stocked | conciliated |
+    -- asset_registered) onde o V2 tem duas. Medido: 71 pendentes e 536
+    -- conclu\xEDdas nos dois tenants.
+    'kind',                     'kind',
+    'op_status',                'status',
+    'access_key',               'idempotency_key',
+    'unit_id',                  'unit_id@companies',
+    'created_at',               'created_at',
+    'updated_at',               'updated_at',
+    'tenant_id',                '-',
+    'status',                   'jsonb:danfe.v1_status',
+    'nfe_number',               'jsonb:danfe.nfe_number',
+    'nfe_series',               'jsonb:danfe.nfe_series',
+    'issue_date',               'jsonb:danfe.issue_date',
+    'nature_operation',         'jsonb:danfe.nature_operation',
+    'supplier_name',            'jsonb:danfe.supplier.name',
+    'supplier_cnpj',            'jsonb:danfe.supplier.cnpj',
+    'supplier_id',              'jsonb:danfe.supplier.v1_ref',
+    'total_value',              'jsonb:danfe.totals.total',
+    'discount_value',           'jsonb:danfe.totals.discount',
+    'freight_value',            'jsonb:danfe.totals.freight',
+    'insurance_value',          'jsonb:danfe.totals.insurance',
+    'other_expenses',           'jsonb:danfe.totals.other',
+    'total_items',              'jsonb:danfe.total_items',
+    'conciliated_items',        'jsonb:danfe.conciliated_items',
+    'imported_by',              'jsonb:danfe.imported_by',
+    'payment_summary',          'jsonb:danfe.payment_summary',
+    'default_chart_account_id', 'jsonb:danfe.v1_default_chart_account_ref',
+    'id',                       'jsonb:danfe.v1_ref'),
+  'A importa\xE7\xE3o de DANFE \xE9 uma opera\xE7\xE3o de RECEBIMENTO, e a idempotency_key '
+  'dela \xE9 a chave de acesso \u2014 607 de 607 notas t\xEAm chave e ela \xE9 \xFAnica no '
+  'tenant, ent\xE3o op.idempotency_key = doc.access_key liga a opera\xE7\xE3o ao '
+  'documento fiscal sem FK entre plugins. O conte\xFAdo fiscal n\xE3o \xE9 copiado: as '
+  '607 notas j\xE1 est\xE3o em plg_fiscalbr_inbox_documents, com o mesmo n\xFAmero de '
+  'linhas em 607 de 607.'
+);
+
+SELECT migration._allow(
+  'danfe_import_items', 'public.plg_inventory_stock_movements', 'inventory', 'inv_danfe_line',
+  jsonb_build_object('part', 'item'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                  'id',
+    'import_id',             'operation_id@danfe_imports',
+    -- O movimento que ESTA linha gerou no V1. Resolve pelo ledger de
+    -- \`stock_movements\`; nulo quando a linha nunca foi conciliada, e
+    -- irresolvido (quarentena \`fk\`) quando o movimento existe e n\xE3o atravessou.
+    'movement_uuid',         'movement_id@stock_movements',
+    'linked_product_id',     'product_id@products',
+    'item_number',           'line_no',
+    'created_at',            'created_at',
+    'tenant_id',             '-',
+    'description',           'jsonb:danfe.line.description',
+    'product_code_supplier', 'jsonb:danfe.line.supplier_code',
+    'ean_barcode',           'jsonb:danfe.line.ean',
+    'ncm',                   'jsonb:danfe.line.ncm',
+    'cfop',                  'jsonb:danfe.line.cfop',
+    'quantity',              'jsonb:danfe.line.quantity',
+    'unit_abbreviation',     'jsonb:danfe.line.unit',
+    'unit_price',            'jsonb:danfe.line.unit_price',
+    'total_price',           'jsonb:danfe.line.total_price',
+    'icms_value',            'jsonb:danfe.line.icms_value',
+    'ipi_value',             'jsonb:danfe.line.ipi_value',
+    'pis_value',             'jsonb:danfe.line.pis_value',
+    'cofins_value',          'jsonb:danfe.line.cofins_value',
+    'entry_type',            'jsonb:danfe.line.entry_type',
+    'cst_entry',             'jsonb:danfe.line.cst_entry',
+    'chart_account_id',      'jsonb:danfe.line.v1_chart_account_ref',
+    'stock_unit_id',         'jsonb:danfe.line.v1_stock_unit_ref',
+    'stock_quantity',        'jsonb:danfe.line.stock_quantity',
+    'conversion_factor',     'jsonb:danfe.line.conversion_factor',
+    'cost_mode',             'jsonb:danfe.line.cost_mode',
+    'reconciled',            'jsonb:danfe.line.reconciled',
+    'xml_batches',           'jsonb:danfe.line.xml_batches',
+    'ai_suggested',          'jsonb:danfe.line.ai.suggested',
+    'ai_create_product',     'jsonb:danfe.line.ai.create_product',
+    'ai_product_name',       'jsonb:danfe.line.ai.product_name',
+    'ai_product_barcode',    'jsonb:danfe.line.ai.product_barcode',
+    'ai_product_cost_price', 'jsonb:danfe.line.ai.product_cost_price',
+    'ai_product_unit_id',    'jsonb:danfe.line.ai.v1_product_unit_ref',
+    'id',                    'jsonb:danfe.line.v1_ref'),
+  'A linha da nota. N\xC3O cria movimento: 2.707 dos 2.860 itens do tenant 8 j\xE1 '
+  't\xEAm o movimento que o V1 gerou, e ele j\xE1 atravessou \u2014 um segundo dobraria a '
+  'entrada e, pelo gatilho after_insert, o saldo junto. A linha adota aquele '
+  'movimento e guarda em operations.result o que ele n\xE3o nomeia: fator de '
+  'convers\xE3o, conta cont\xE1bil, CST de entrada e o produto sugerido pela IA.'
+);
+
+SELECT migration._allow(
+  'danfe_import_item_batches', 'public.plg_inventory_stock_positions', 'inventory', 'inv_danfe_line',
+  jsonb_build_object('part', 'batch'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                 'id',
+    'import_id',            'operation_id@danfe_imports',
+    'product_ref',          'product_id@products',
+    'stock_location_id',    'stock_location_id@stock_locations',
+    'stock_movement_uuid',  'movement_id@stock_movements',
+    'quantity',             'quantity',
+    'batch_number',         'batch_number',
+    'expiration_date',      'expiration_date',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'item_id',              'jsonb:danfe.batch.v1_item_ref',
+    'received_at',          'jsonb:danfe.batch.received_at',
+    'received_by',          'jsonb:danfe.batch.v1_received_by',
+    'source',               'jsonb:danfe.batch.source',
+    'id',                   'jsonb:danfe.batch.v1_ref'),
+  'O lote declarado na entrada \u2014 66 no tenant 1 (todos do XML) e 2 no tenant 8 '
+  '(manuais). N\xE3o desfaz a 005: a posi\xE7\xE3o continua sendo consequ\xEAncia do '
+  'movimento e este de-para n\xE3o grava nenhuma. O gatilho after_insert j\xE1 criou '
+  'a posi\xE7\xE3o com este lote e esta validade, e a linha do lote aponta para ela. '
+  '32 dos 68 lotes t\xEAm movimento; os outros 36 ficam skipped, porque lote sem '
+  'movimento nunca foi saldo.'
+);
+
+DELETE FROM migration.excluded_tables
+ WHERE source_table IN ('danfe_imports', 'danfe_import_items', 'danfe_import_item_batches');
+
+RESET migration.allowlist_unlock;
+
+
+-- \u2500\u2500 quem pode executar \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Fun\xE7\xE3o nova nasce execut\xE1vel por PUBLIC, e \`anon\`/\`authenticated\` herdam
+-- dali. Estas s\xE3o de PORTE: SECURITY DEFINER, escrevem dados de qualquer
+-- inquilino, e uma delas alcan\xE7\xE1vel pela chave an\xF4nima \xE9 a base inteira
+-- alcan\xE7\xE1vel pela chave an\xF4nima. S\xF3 o service_role, que \xE9 quem roda a onda.
+REVOKE ALL ON FUNCTION migration.upsert_inv_shape(uuid, uuid, jsonb, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION migration.upsert_inv_shape(uuid, uuid, jsonb, jsonb) TO service_role;
+REVOKE ALL ON FUNCTION migration.upsert_inv_danfe_line(uuid, uuid, jsonb, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION migration.upsert_inv_danfe_line(uuid, uuid, jsonb, jsonb) TO service_role;
+`;
+var MIGRATION_011_O_CONSUMO_TEM_DUAS_ORIGENS = `-- 011_o_consumo_tem_duas_origens.sql
+--
+-- A AUDITORIA DE USO ESTAVA VAZIA, E A CULPA N\xC3O ERA DELA.
+--
+-- A 001 leu o consumo no \xFAnico lugar onde ele existia quando foi escrita: o
+-- raz\xE3o, \`plg_inventory_stock_movements\` com \`source_item_type='order_item'\`.
+-- Isso pressup\xF5e que consumir DEU BAIXA. \xC9 verdade para o consumo que nasce no
+-- V2 \u2014 \`order.completed\` consome a receita no mesmo instante \u2014 e \xE9 falso para
+-- tudo o que veio do V1.
+--
+-- O N\xDAMERO QUE OBRIGA ESTA MIGRATION. No V1, tenant 1:
+--
+--   execution_products ......................... 117.024 linhas
+--   stock_deducted = true ...................... 0
+--   stock_movement_id preenchido ............... 0
+--
+-- Zero. Em nenhum momento da hist\xF3ria daquele banco o consumo declarado virou
+-- movimento de estoque \u2014 \xE9 exatamente o que os dois FLOW.md descrevem: no V1 a
+-- auditoria \xE9 um PORT\xC3O PR\xC9-BAIXA, e a fila nunca foi drenada. Migrado, esse
+-- hist\xF3rico chegou ao V2 como \`plg_clinical_session_products\` (116.911 linhas
+-- no Espa\xE7o Facial) e n\xE3o produziu nenhum movimento, porque n\xE3o havia nenhum
+-- para produzir.
+--
+-- Resultado medido no cluster, pelo papel \`authenticated\` com as claims do
+-- tenant: \`v_inventory_consumption_audit\` devolvia **0 linhas**. A tela do V2 \xE9 um
+-- porte fiel da do V1 \u2014 produto, quantidade com o \xABPadr\xE3o: N\xBB s\xF3 quando
+-- diverge, \xABSem posi\xE7\xE3o\xBB, data, profissional, cliente \u2014 e estava passando
+-- fome.
+--
+-- O QUE MUDA AQUI: o consumo passa a ter DUAS ORIGENS.
+--
+--   \`ledger\`   \u2014 a baixa que realmente saiu do estoque (a 001, intacta).
+--   \`clinical\` \u2014 a declara\xE7\xE3o do atendimento que nunca virou baixa.
+--
+-- A PERGUNTA DA TELA \xC9 A MESMA NAS DUAS. \xABO que o profissional disse ter usado
+-- bate com o padr\xE3o?\xBB n\xE3o depende de o saldo ter mudado. O que muda \xE9 o que
+-- \xABcorrigir\xBB significa, e \xE9 por isso que a vista ganha \`stock_posted\`: na
+-- origem do raz\xE3o corrigir DEVOLVE ao saldo; na origem cl\xEDnica n\xE3o h\xE1 o que
+-- devolver, e corrigir \xE9 o mesmo ato do V1 \u2014 conserta a quantidade declarada e
+-- aprova.
+--
+-- POR QUE N\xC3O UMA FILA NOVA. Pelo mesmo motivo da 001: seria um segundo lugar
+-- guardando a mesma quantidade. \`plg_clinical_session_products\` J\xC1 \xE9 o registro
+-- do consumo declarado, com \`default_quantity\` (o \xABPadr\xE3o: N\xBB do V1),
+-- \`used_quantity\`, \`is_audited\`, \`audited_at\` e \`audit_notes\`. A auditoria l\xEA
+-- de onde o dado mora.
+--
+-- FORMA DA VISTA: as 29 colunas existentes continuam nas mesmas posi\xE7\xF5es e com
+-- os MESMOS tipos \u2014 \`variance\` \xE9 \`numeric\` sem typmod, e um \`numeric(14,4)\` ali
+-- faria o \`CREATE OR REPLACE\` recusar. As duas colunas novas entram no fim, que
+-- \xE9 o \xFAnico lugar onde o REPLACE aceita coluna nova. Nada de DROP: consultado o
+-- \`pg_depend\`, nada depende desta vista hoje, e mesmo assim um DROP CASCADE
+-- aqui seria o quarto acidente da casa.
+--
+-- \`security_invoker\` PRESERVADO. Sem ele a vista leria com os direitos de quem
+-- a criou e furaria a RLS das duas origens.
+--
+-- CONSEQU\xCANCIA CONHECIDA, e ela \xE9 de prop\xF3sito: com \`security_invoker\`, a
+-- origem cl\xEDnica \xE9 filtrada pela policy de \`plg_clinical_session_products\`, que
+-- exige \`clinical.read\`. Um estoquista com \`inventory.read\` e sem
+-- \`clinical.read\` continua vendo a auditoria vazia. Alargar isso \xE9 decis\xE3o da
+-- policy do plugin cl\xEDnico \u2014 dono da tabela \u2014, n\xE3o de uma migration do estoque,
+-- e escond\xEA-la atr\xE1s de um \`security_definer\` seria trocar uma tela vazia por
+-- um vazamento.
+
+-- \u2500\u2500 replay-safety \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- DROP before CREATE, and the reason is the rule this file exists under: the
+-- chain bench re-applies every migration on a populated database, and
+-- \`CREATE OR REPLACE VIEW\` may only APPEND columns \u2014 it refuses a narrower
+-- column list with "cannot drop columns from view". Files 012 through 018
+-- each widen this view, so on the second pass this statement would meet the
+-- final, wider shape and fail.
+--
+-- Dropping is free here and nowhere else: this view is born in this file. Its
+-- predecessor \`v_inventory_usage_audit\` (001, applied 2026-09-06) keeps its own
+-- name and its own narrow contract precisely so that it never has to be
+-- touched \u2014 an applied file with a changed checksum is a hard stop for
+-- \`fayz db apply\` on every cluster that already ran it.
+DROP VIEW IF EXISTS public.v_inventory_consumption_audit CASCADE;
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit
+WITH (security_invoker = 'true') AS
+WITH consumed AS (
+  SELECT m.tenant_id,
+         m.unit_id,
+         m.source_item_id AS item_id,
+         m.product_id,
+         -- o raz\xE3o guarda sa\xEDda como negativo; quem confere pensa em positivo
+         sum(- m.quantity) AS posted_quantity,
+         sum(m.total_cost) AS total_cost,
+         min(m.created_at) AS used_at,
+         min(m.movement_date) AS movement_date,
+         (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+         count(DISTINCT m.source_location_id)::int AS location_count,
+         (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+         (array_agg(m.metadata ->> 'recipe_id' ORDER BY m.created_at, m.id))[1] AS recipe_id
+    FROM public.plg_inventory_stock_movements m
+   WHERE m.source_item_type = 'order_item'
+     AND m.source_item_id IS NOT NULL
+     AND m.kind = 'out'
+     -- estornado n\xE3o \xE9 consumo: devolver ao estoque apaga a linha da fila
+     AND NOT EXISTS (
+       SELECT 1 FROM public.plg_inventory_stock_movements r
+        WHERE r.reverses_movement_id = m.id
+     )
+   GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+), corrected AS (
+  SELECT c.tenant_id,
+         c.source_item_id AS item_id,
+         c.product_id,
+         -- devolver ao estoque \xE9 ajuste positivo, e reduz o consumido
+         sum(- c.quantity) AS correction_delta,
+         -- o raz\xE3o guarda custo sempre positivo; o sinal vem da quantidade
+         sum(- sign(c.quantity) * c.total_cost) AS correction_cost,
+         max(c.created_at) AS corrected_at,
+         (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+    FROM public.plg_inventory_stock_movements c
+   WHERE c.source_item_type = 'usage_audit'
+     AND c.source_item_id IS NOT NULL
+   GROUP BY c.tenant_id, c.source_item_id, c.product_id
+),
+
+-- \u2500\u2500 origem 1: o consumo que saiu do estoque (a 001, sem uma v\xEDrgula a menos) \u2500
+ledger AS (
+  SELECT c.tenant_id,
+         c.unit_id,
+         c.item_id,
+         c.product_id,
+         p.name AS product_name,
+         p.sku  AS product_sku,
+         c.used_at,
+         c.movement_date,
+         c.posted_quantity,
+         (c.posted_quantity + coalesce(k.correction_delta, 0)) AS net_quantity,
+         std.standard_quantity,
+         CASE WHEN std.standard_quantity IS NULL THEN NULL
+              ELSE ((c.posted_quantity + coalesce(k.correction_delta, 0))
+                    - std.standard_quantity)
+         END AS variance,
+         u.abbreviation AS unit_abbreviation,
+         -- o custo acompanha a conclus\xE3o da auditoria, n\xE3o o que foi lan\xE7ado:
+         -- devolver um frasco devolve o custo dele junto
+         (c.total_cost + coalesce(k.correction_cost, 0)) AS total_cost,
+         c.stock_location_id,
+         sl.name AS stock_location_name,
+         -- mais de uma posi\xE7\xE3o quer dizer que o FIFO atravessou lotes
+         c.location_count,
+         r.id   AS recipe_id,
+         r.name AS recipe_name,
+         i.order_id,
+         i.name AS item_name,
+         o.reference_number AS order_reference,
+         i.assignee_id AS performed_by_id,
+         perf.name AS performed_by_name,
+         o.party_id AS customer_id,
+         cust.name AS customer_name,
+         k.corrected_at,
+         k.correction_reason,
+         (k.item_id IS NOT NULL) AS is_corrected,
+         'ledger'::text AS source,
+         true AS stock_posted
+    FROM consumed c
+    LEFT JOIN corrected k
+           ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+    LEFT JOIN public.products p ON p.id = c.product_id
+    LEFT JOIN public.plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+    LEFT JOIN public.plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+    -- A linha vendida e seu pedido chegam por LEFT JOIN de prop\xF3sito: quem l\xEA o
+    -- estoque pode n\xE3o ler a venda, e nesse caso a linha aparece sem o nome do
+    -- profissional em vez de desaparecer da confer\xEAncia.
+    LEFT JOIN public.items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+    LEFT JOIN public.orders o ON o.id = i.order_id
+    LEFT JOIN public.people perf ON perf.id = i.assignee_id
+    LEFT JOIN public.people cust ON cust.id = o.party_id
+    LEFT JOIN public.plg_inventory_recipes r
+           ON r.id = nullif(c.recipe_id, '')::uuid AND r.tenant_id = c.tenant_id
+    LEFT JOIN LATERAL (
+      SELECT CASE
+               WHEN r.id IS NOT NULL AND coalesce(r.yield_quantity, 0) > 0 THEN (
+                 SELECT round(sum(ri.quantity) * coalesce(i.quantity, 1) / r.yield_quantity, 4)
+                   FROM public.plg_inventory_recipe_ingredients ri
+                  WHERE ri.tenant_id = c.tenant_id
+                    AND ri.recipe_id = r.id
+                    AND ri.product_id = c.product_id
+               )
+               -- sem receita o produto vendido \xE9 o pr\xF3prio consumido: o padr\xE3o \xE9
+               -- a quantidade da linha, e divergir a\xED seria erro de sistema
+               WHEN r.id IS NULL THEN i.quantity
+               ELSE NULL
+             END AS standard_quantity
+    ) std ON true
+),
+
+-- \u2500\u2500 origem 2: a declara\xE7\xE3o do atendimento que nunca virou baixa \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- IDENTIDADE. A vista \xE9 chaveada por (item_id, produto), e 116.144 das 116.911
+-- linhas cl\xEDnicas n\xE3o t\xEAm \`order_item_id\` \u2014 o consumo do V1 pendurava na
+-- execu\xE7\xE3o, n\xE3o na linha vendida. Ent\xE3o \`item_id\` aqui \xE9 o \`id\` da PR\xD3PRIA
+-- linha cl\xEDnica. Ela \xE9 \xFAnica, \xE9 est\xE1vel, \xE9 o que a tela usa como chave de linha
+-- e \xE9 por ela que a corre\xE7\xE3o encontra o registro de volta.
+--
+-- O PADR\xC3O VEM DO V1, N\xC3O DA RECEITA. \`default_quantity\` \xE9 literalmente o
+-- \xABPadr\xE3o: N\xBB que a tela do V1 mostrava \u2014 o n\xFAmero que estava cadastrado no
+-- servi\xE7o no dia do atendimento. Recalcular pela receita vigente do V2 seria
+-- comparar o passado com um padr\xE3o que ele n\xE3o teve.
+--
+-- \`nullif(default_quantity, 0)\` N\xC3O \xC9 COSM\xC9TICO: 377 linhas vieram com padr\xE3o
+-- zero, que no V1 quer dizer \xABsem padr\xE3o cadastrado\xBB (a tela testa
+-- \`default_quantity > 0\` antes de mostrar o selo). Sem o nullif, cada uma delas
+-- viraria uma diverg\xEAncia do valor inteiro e o filtro \xABs\xF3 divergentes\xBB passaria
+-- de 172 achados reais para 421 \u2014 afogar o achado \xE9 o mesmo que n\xE3o ter achado.
+clinical AS (
+  SELECT cs.tenant_id,
+         cs.unit_id,
+         cs.id AS item_id,
+         cs.product_id,
+         p.name AS product_name,
+         p.sku  AS product_sku,
+         coalesce(cs.executed_on::timestamptz, cs.created_at) AS used_at,
+         coalesce(cs.executed_on, cs.created_at::date) AS movement_date,
+         -- N\xE3o houve postagem. \xABposted\xBB aqui \xE9 o DECLARADO, e quem diz a verdade
+         -- sobre o raz\xE3o \xE9 \`stock_posted = false\`, logo abaixo. Igual ao V1,
+         -- corrigir reescreve \`used_quantity\` no lugar, ent\xE3o declarado e
+         -- l\xEDquido s\xE3o sempre o mesmo n\xFAmero nesta origem.
+         coalesce(cs.used_quantity, 0) AS posted_quantity,
+         coalesce(cs.used_quantity, 0) AS net_quantity,
+         nullif(cs.default_quantity, 0) AS standard_quantity,
+         CASE WHEN nullif(cs.default_quantity, 0) IS NULL THEN NULL
+              ELSE coalesce(cs.used_quantity, 0) - cs.default_quantity
+         END AS variance,
+         u.abbreviation AS unit_abbreviation,
+         -- custo zero n\xE3o \xE9 \xABn\xE3o sei\xBB: \xE9 \xABnada saiu do estoque, logo nada
+         -- custou ao estoque\xBB. Inventar aqui o pre\xE7o de cat\xE1logo daria \xE0 tela
+         -- um valor que nenhum raz\xE3o jamais escreveu.
+         0::numeric AS total_cost,
+         NULL::uuid AS stock_location_id,
+         NULL::text AS stock_location_name,
+         -- o V1 mostrava \xABSem posi\xE7\xE3o\xBB em 117.024 de 117.024 linhas; a aus\xEAncia
+         -- de local aqui \xE9 o porte fiel daquele selo, n\xE3o uma perda de dado
+         1 AS location_count,
+         NULL::uuid AS recipe_id,
+         NULL::text AS recipe_name,
+         i.order_id,
+         -- o V1 mostrava o SERVI\xC7O na linha; no V2 o servi\xE7o \xE9 um \`products\`
+         sv.name AS item_name,
+         o.reference_number AS order_reference,
+         coalesce(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+         perf.name AS performed_by_name,
+         s.party_id AS customer_id,
+         cust.name AS customer_name,
+         -- \xABCorrigir\xBB e \xABAprovar\xBB eram um ato s\xF3 no V1: auditado \xE9 o conferido
+         cs.audited_at AS corrected_at,
+         cs.audit_notes AS correction_reason,
+         cs.is_audited AS is_corrected,
+         'clinical'::text AS source,
+         false AS stock_posted
+    FROM public.plg_clinical_session_products cs
+    LEFT JOIN public.plg_clinical_sessions s
+           ON s.tenant_id = cs.tenant_id AND s.id = cs.session_id
+    LEFT JOIN public.products p ON p.id = cs.product_id
+    LEFT JOIN public.products sv ON sv.id = s.service_id
+    LEFT JOIN public.plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+    LEFT JOIN public.items i ON i.id = cs.order_item_id AND i.tenant_id = cs.tenant_id
+    LEFT JOIN public.orders o ON o.id = i.order_id
+    LEFT JOIN public.people perf ON perf.id = coalesce(cs.assignee_id, s.performed_by_id, s.assignee_id)
+    LEFT JOIN public.people cust ON cust.id = s.party_id
+   -- A MESMA LINHA N\xC3O CONTA DUAS VEZES. Se a declara\xE7\xE3o cl\xEDnica j\xE1 produziu
+   -- uma sa\xEDda no raz\xE3o, quem manda \xE9 o raz\xE3o: \xE9 ele que tem custo, posi\xE7\xE3o e
+   -- a corre\xE7\xE3o que devolve saldo.
+   --
+   -- O teste de estorno N\xC3O se repete aqui de prop\xF3sito. A 001 decidiu que
+   -- sa\xEDda estornada sai da fila; se o g\xEAmeo cl\xEDnico reaparecesse quando o
+   -- estorno acontece, a mesma linha voltaria \xE0 confer\xEAncia pela porta dos
+   -- fundos e diria o contr\xE1rio do que a 001 disse.
+   WHERE NOT EXISTS (
+     SELECT 1
+       FROM public.plg_inventory_stock_movements m
+      WHERE m.tenant_id = cs.tenant_id
+        AND m.source_item_type = 'order_item'
+        AND m.source_item_id = cs.order_item_id
+        AND m.product_id = cs.product_id
+        AND m.kind = 'out'
+   )
+)
+
+-- O casco externo existe pelos TYPMODS. Um UNION apaga \`numeric(14,4)\` e deixa
+-- \`numeric\` puro, e o \`CREATE OR REPLACE VIEW\` recusa mudan\xE7a de tipo de coluna
+-- existente \u2014 inclusive typmod. Ent\xE3o cada coluna volta ao tipo que ela j\xE1
+-- tinha, um a um. \`variance\` fica \`numeric\` SEM typmod porque \xE9 assim que ela
+-- est\xE1 no cat\xE1logo hoje; apert\xE1-la para \`numeric(14,4)\` seria o mesmo erro pelo
+-- lado oposto.
+SELECT a.tenant_id,
+       a.unit_id,
+       a.item_id,
+       a.product_id,
+       a.product_name,
+       a.product_sku,
+       a.used_at,
+       a.movement_date,
+       a.posted_quantity::numeric(14,4)  AS posted_quantity,
+       a.net_quantity::numeric(14,4)     AS net_quantity,
+       a.standard_quantity::numeric(14,4) AS standard_quantity,
+       a.variance::numeric               AS variance,
+       a.unit_abbreviation,
+       a.total_cost::numeric(16,4)       AS total_cost,
+       a.stock_location_id,
+       a.stock_location_name,
+       a.location_count,
+       a.recipe_id,
+       a.recipe_name,
+       a.order_id,
+       a.item_name,
+       a.order_reference,
+       a.performed_by_id,
+       a.performed_by_name,
+       a.customer_id,
+       a.customer_name,
+       a.corrected_at,
+       a.correction_reason,
+       a.is_corrected,
+       -- \u2500\u2500 colunas novas, no fim, que \xE9 onde o REPLACE aceita \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+       a.source,
+       a.stock_posted
+  FROM (
+    SELECT * FROM ledger
+    UNION ALL
+    SELECT * FROM clinical
+  ) a;
+
+COMMENT ON VIEW public.v_inventory_consumption_audit IS
+  'O consumo declarado em cada atendimento ao lado do padr\xE3o, por linha e produto, nas suas duas origens: o que saiu do raz\xE3o (source=ledger) e o que o V1 declarou e nunca baixou (source=clinical, stock_posted=false). N\xE3o cria fila: os dois lugares j\xE1 guardavam tudo (001, 011).';
+
+GRANT SELECT ON public.v_inventory_consumption_audit TO authenticated;
+GRANT SELECT ON public.v_inventory_consumption_audit TO service_role;
+
+-- \u2500\u2500 \xEDndices: a confer\xEAncia \xE9 sempre (tenant, mais recente primeiro) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A tela pagina 50 por vez ordenando por \`used_at DESC\` sobre 116.911 linhas.
+-- Sem isto a vista varre a tabela inteira a cada p\xE1gina.
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_audit_idx
+  ON public.plg_clinical_session_products (tenant_id, executed_on DESC, id);
+
+-- O anti-join da deduplica\xE7\xE3o entra pelo par (linha vendida, produto)
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_order_item_idx
+  ON public.plg_clinical_session_products (tenant_id, order_item_id, product_id)
+  WHERE order_item_id IS NOT NULL;
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- CORRIGIR, NA ORIGEM CL\xCDNICA
+--
+-- A 002 fez de \`app.inventory_correct_usage_line\` o miolo \xFAnico: a corre\xE7\xE3o
+-- avulsa e o lote s\xE3o o mesmo c\xF3digo. Ele procura a baixa no raz\xE3o e, n\xE3o
+-- achando, levanta \xABno usage of product % on item % to correct\xBB. Com a vista
+-- servindo 116.890 linhas cl\xEDnicas, esse erro passaria a ser a resposta normal
+-- da tela \u2014 o bot\xE3o existiria s\xF3 para falhar.
+--
+-- O QUE CORRIGIR SIGNIFICA EM CADA ORIGEM:
+--
+--   raz\xE3o    \u2014 a baixa aconteceu; corrigir 50 para 40 DEVOLVE 10 ao saldo, como
+--              ajuste, porque o raz\xE3o \xE9 append-only. (inalterado)
+--   cl\xEDnica  \u2014 nada saiu; n\xE3o h\xE1 o que devolver. Corrigir \xE9 o ato do V1:
+--              conserta a quantidade declarada, exige motivo, e APROVA junto \u2014
+--              \xABSalvar e Aprovar\xBB era um bot\xE3o s\xF3, nunca dois.
+--
+-- Lan\xE7ar um ajuste de estoque para a origem cl\xEDnica seria pior que n\xE3o
+-- corrigir: criaria movimento para um consumo que nunca teve movimento, e o
+-- saldo passaria a contar uma devolu\xE7\xE3o de algo que nunca saiu.
+--
+-- PERMISS\xC3O, EXPLICITAMENTE. A fun\xE7\xE3o \xE9 SECURITY DEFINER, ent\xE3o o UPDATE n\xE3o
+-- passa pela RLS de \`plg_clinical_session_products\` \u2014 quem tem de barrar \xE9 este
+-- c\xF3digo. Exige-se \`inventory.edit\` na unidade do consumo, que \xE9 a mesma regra
+-- do caminho do raz\xE3o (\`inventory_authorize_location\` cobra \`inventory.edit\` na
+-- unidade do local). Linha sem unidade (906 delas) cai no teste \xABem qualquer
+-- unidade\xBB, espelhando o \`unit_id IS NULL OR has_unit(...)\` da pr\xF3pria policy.
+CREATE OR REPLACE FUNCTION app.inventory_correct_usage_line(
+  p_tenant uuid,
+  p_op uuid,
+  p_key text,
+  p_line_no integer,
+  p_item_id uuid,
+  p_product_id uuid,
+  p_quantity numeric,
+  p_reason text
+) RETURNS jsonb
+  LANGUAGE plpgsql
+  SECURITY DEFINER
+  SET search_path TO ''
+AS $$
+DECLARE
+  v_row record;
+  v_cs record;
+  v_delta numeric;
+  v_unit uuid;
+  v_id uuid;
+BEGIN
+  IF p_quantity IS NULL OR p_quantity < 0 THEN
+    RAISE EXCEPTION 'inventory: the corrected quantity cannot be negative' USING ERRCODE = '22023';
+  END IF;
+
+  -- o consumido de hoje: a baixa original mais o que auditorias j\xE1 corrigiram
+  SELECT sum(- m.quantity) AS net,
+         (array_agg(m.source_location_id ORDER BY m.created_at DESC, m.id DESC))[1] AS location_id,
+         (array_agg(m.measurement_unit_id ORDER BY m.created_at DESC, m.id DESC))[1] AS measurement_unit_id,
+         (array_agg(m.batch_number ORDER BY m.created_at DESC, m.id DESC))[1] AS batch_number,
+         (array_agg(m.expiration_date ORDER BY m.created_at DESC, m.id DESC))[1] AS expiration_date,
+         (array_agg(m.unit_cost ORDER BY m.created_at DESC, m.id DESC))[1] AS unit_cost
+    INTO v_row
+    FROM public.plg_inventory_stock_movements m
+   WHERE m.tenant_id = p_tenant
+     AND m.source_item_id = p_item_id
+     AND m.product_id = p_product_id
+     AND ((m.source_item_type = 'order_item' AND m.kind = 'out')
+       OR (m.source_item_type = 'usage_audit' AND m.kind = 'adjust'))
+     AND NOT EXISTS (
+       SELECT 1 FROM public.plg_inventory_stock_movements r
+        WHERE r.reverses_movement_id = m.id
+     );
+
+  -- \u2500\u2500 a origem cl\xEDnica: consumo declarado que nunca virou baixa \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  IF v_row.net IS NULL THEN
+    SELECT cs.id, cs.unit_id, cs.used_quantity, cs.is_audited
+      INTO v_cs
+      FROM public.plg_clinical_session_products cs
+     WHERE cs.tenant_id = p_tenant
+       AND cs.id = p_item_id
+       AND cs.product_id = p_product_id;
+
+    IF v_cs.id IS NULL THEN
+      RAISE EXCEPTION 'inventory: no usage of product % on item % to correct', p_product_id, p_item_id
+        USING ERRCODE = '22023';
+    END IF;
+
+    IF v_cs.unit_id IS NOT NULL THEN
+      IF NOT app.has_unit(v_cs.unit_id) THEN
+        RAISE EXCEPTION 'inventory: no access to the unit of usage %', p_item_id USING ERRCODE = '42501';
+      END IF;
+      IF NOT app.has_permission('inventory.edit', v_cs.unit_id) THEN
+        RAISE EXCEPTION 'inventory: inventory.edit required at the unit of usage %', p_item_id
+          USING ERRCODE = '42501';
+      END IF;
+    ELSIF NOT app.has_permission_anywhere('inventory.edit') THEN
+      RAISE EXCEPTION 'inventory: inventory.edit required to correct usage %', p_item_id
+        USING ERRCODE = '42501';
+    END IF;
+
+    -- Conferir e n\xE3o mudar n\xFAmero AINDA \xE9 conferir: a linha pendente vira
+    -- auditada. S\xF3 \xE9 \xABunchanged\xBB o que j\xE1 estava auditado com este n\xFAmero \u2014
+    -- reenviar o mesmo lote n\xE3o reescreve a data da auditoria.
+    IF coalesce(v_cs.used_quantity, 0) = p_quantity AND v_cs.is_audited THEN
+      RETURN jsonb_build_object('status', 'unchanged', 'origin', 'clinical',
+                                'item_id', p_item_id, 'product_id', p_product_id,
+                                'previous_quantity', coalesce(v_cs.used_quantity, 0),
+                                'quantity', p_quantity, 'delta', 0);
+    END IF;
+
+    UPDATE public.plg_clinical_session_products
+       SET used_quantity = p_quantity,
+           is_audited    = true,
+           audited_at    = now(),
+           audited_by    = auth.uid(),
+           audit_notes   = p_reason,
+           updated_at    = now()
+     WHERE tenant_id = p_tenant AND id = p_item_id AND product_id = p_product_id;
+
+    -- Sem \`movements\`: nada entrou no raz\xE3o, e devolver uma lista vazia \xE9 o que
+    -- diz isso a quem chamou. O lote continua contando a linha como aplicada.
+    RETURN jsonb_build_object('status', 'corrected', 'origin', 'clinical',
+                              'item_id', p_item_id, 'product_id', p_product_id,
+                              'unit_id', v_cs.unit_id,
+                              'previous_quantity', coalesce(v_cs.used_quantity, 0),
+                              'quantity', p_quantity,
+                              'delta', coalesce(v_cs.used_quantity, 0) - p_quantity,
+                              'movements', '[]'::jsonb);
+  END IF;
+
+  -- \u2500\u2500 a origem do raz\xE3o: inalterada desde a 002 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- positivo devolve ao estoque, negativo tira mais
+  v_delta := v_row.net - p_quantity;
+  IF v_delta = 0 THEN
+    RETURN jsonb_build_object('status', 'unchanged', 'origin', 'ledger', 'item_id', p_item_id,
+                              'product_id', p_product_id, 'previous_quantity', v_row.net,
+                              'quantity', p_quantity, 'delta', 0);
+  END IF;
+
+  IF v_delta < 0
+     AND app.inventory_available(p_tenant, p_product_id, v_row.location_id,
+                                 v_row.batch_number, v_row.expiration_date) < - v_delta THEN
+    RAISE EXCEPTION 'inventory: correcting to % would take product % below its available quantity at location %',
+      p_quantity, p_product_id, v_row.location_id USING ERRCODE = '23514';
+  END IF;
+
+  v_unit := app.inventory_authorize_location(p_tenant, v_row.location_id, 'inventory.edit');
+
+  INSERT INTO public.plg_inventory_stock_movements
+    (tenant_id, product_id, kind, quantity, unit_cost, source_location_id,
+     batch_number, expiration_date, measurement_unit_id, document_type,
+     reason, source_item_type, source_item_id, idempotency_key, line_no,
+     operation_id, metadata)
+  VALUES
+    (p_tenant, p_product_id, 'adjust', v_delta, coalesce(v_row.unit_cost, 0), v_row.location_id,
+     v_row.batch_number, v_row.expiration_date, v_row.measurement_unit_id, 'adjustment',
+     p_reason, 'usage_audit', p_item_id, p_key, p_line_no, p_op,
+     jsonb_build_object('source', 'usage_audit', 'order_item_id', p_item_id,
+                        'posted_quantity', v_row.net, 'corrected_quantity', p_quantity))
+  RETURNING id INTO v_id;
+
+  RETURN jsonb_build_object('status', 'corrected', 'origin', 'ledger', 'item_id', p_item_id,
+                            'product_id', p_product_id, 'location_id', v_row.location_id,
+                            'unit_id', v_unit, 'previous_quantity', v_row.net,
+                            'quantity', p_quantity, 'delta', v_delta,
+                            'movements', app.inventory_movement_json(v_id));
+END $$;
+
+COMMENT ON FUNCTION app.inventory_correct_usage_line(uuid, uuid, text, integer, uuid, uuid, numeric, text) IS
+  'Uma linha de corre\xE7\xE3o de consumo dentro de uma opera\xE7\xE3o j\xE1 aberta. Origem raz\xE3o: lan\xE7a a diferen\xE7a como ajuste. Origem cl\xEDnica (consumo do V1 que nunca baixou): conserta a quantidade declarada e aprova, sem tocar no saldo (002, 011).';
+
+REVOKE ALL ON FUNCTION app.inventory_correct_usage_line(uuid, uuid, text, integer, uuid, uuid, numeric, text) FROM PUBLIC;
+`;
+var MIGRATION_012_O_CONSUMO_CLINICO_NAO_PRECISA_DA_TABELA_DE_ITENS_INTEIRA = `-- O consumo cl\xEDnico n\xE3o precisa da tabela de itens inteira.
+--
+-- A auditoria de uso continuava estourando o \`statement_timeout\` do papel
+-- \`authenticated\` (8 s) mesmo depois de a clinical/003 baratear a pol\xEDtica. O
+-- plano, lido com o tempo solto, mostrou onde:
+--
+--     Hash  (cost=154686.67 rows=23255)  (actual rows=455925)
+--
+-- O ramo cl\xEDnico da vista faz \`LEFT JOIN items i ON i.id = cs.order_item_id\`, e
+-- o planejador resolve isso montando um hash de \`public.items\` INTEIRA \u2014
+-- 455.925 linhas \u2014 para casar com 116.911 consumos. S\xF3 que **767** desses
+-- consumos t\xEAm \`order_item_id\`: no V1 o produto usado pendura na execu\xE7\xE3o, n\xE3o
+-- na linha vendida. O hash existe para 0,7% das linhas e \xE9 pago por 100%.
+--
+-- O mesmo vale para \`orders\` e para as duas idas a \`people\` (120.808 linhas
+-- cada uma, uma para quem executou e outra para a cliente).
+--
+-- \u2500\u2500 A corre\xE7\xE3o \xE9 a forma do join, n\xE3o o dado \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Cada um vira LATERAL com a condi\xE7\xE3o de exist\xEAncia dentro. Assim o planejador
+-- deixa de montar hash e passa a fazer busca por chave prim\xE1ria \u2014 767 buscas em
+-- vez de um hash de 455 mil linhas \u2014, e as linhas sem \`order_item_id\` n\xE3o
+-- procuram nada.
+--
+-- \`LEFT JOIN LATERAL ... ON true\` preserva a sem\xE2ntica do LEFT JOIN: a linha do
+-- consumo sobrevive mesmo quando n\xE3o h\xE1 item, que \xE9 o caso de 116.144 delas.
+--
+-- Medido no cluster, como o usu\xE1rio que estava com a tela aberta, com ROLLBACK:
+--
+--     50 linhas ordenadas por data   1,94 s   (antes: estourava os 8 s)
+--     contagem total                 1,27 s   116.911 linhas \u2014 a MESMA de antes
+--
+-- A contagem id\xEAntica \xE9 o teste que importa: uma vista que fica r\xE1pida
+-- devolvendo menos linha n\xE3o ficou r\xE1pida, ficou errada.
+--
+-- Idempotente. \`CREATE OR REPLACE\` mant\xE9m nome, ordem e tipo das colunas \u2014 s\xF3
+-- os joins mudam \u2014 e mant\xE9m \`security_invoker\`, sem o qual a vista passaria a
+-- ler com os direitos de quem a criou e furaria a RLS.
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            perf.name AS performed_by_name,
+            o.party_id AS customer_id,
+            cust.name AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            COALESCE(cs.executed_on::timestamp with time zone, cs.created_at) AS used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            perf.name AS performed_by_name,
+            s.party_id AS customer_id,
+            cust.name AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN plg_clinical_sessions s ON s.tenant_id = cs.tenant_id AND s.id = cs.session_id
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id) o ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id)) perf ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = s.party_id) cust ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_013_A_FILA_DE_AUDITORIA_TEM_UMA_JANELA = `-- A fila de auditoria tem uma janela, e a janela precisa de \xEDndice.
+--
+-- \`v_inventory_consumption_audit\` atravessa a hist\xF3ria inteira do consumo. No Espa\xE7o
+-- Facial isso \xE9 116.939 linhas, e pedir as 50 mais recentes custava 7 s de
+-- banco: a tela voltava \`canceling statement due to statement timeout\` e, pior,
+-- mostrava "Nenhum consumo fora do padr\xE3o" por cima do erro.
+--
+-- A tela passou a pedir uma janela (\`used_at >= agora - 30 dias\`), mas o ramo
+-- cl\xEDnico n\xE3o tinha como responder por ela: \`used_at\` \xE9
+-- \`coalesce(executed_on::timestamptz, created_at)\` e essa express\xE3o N\xC3O \xE9
+-- index\xE1vel \u2014 o cast de \`date\` para \`timestamptz\` depende do fuso da sess\xE3o e
+-- o Postgres o recusa em \xEDndice.
+--
+-- \`timezone('UTC', executed_on::timestamp)\` \xE9 o MESMO valor (o cluster roda em
+-- UTC) e \xE9 imut\xE1vel. Trocada a express\xE3o, o \xEDndice abaixo existe e a janela
+-- deixa de ser uma varredura.
+
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_used_at_idx
+  ON public.plg_clinical_session_products (
+    tenant_id,
+    (COALESCE(timezone('UTC', executed_on::timestamp), created_at)) DESC
+  );
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            perf.name AS performed_by_name,
+            o.party_id AS customer_id,
+            cust.name AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            COALESCE(timezone('UTC', cs.executed_on::timestamp), cs.created_at) AS used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            perf.name AS performed_by_name,
+            s.party_id AS customer_id,
+            cust.name AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN plg_clinical_sessions s ON s.tenant_id = cs.tenant_id AND s.id = cs.session_id
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id) o ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id)) perf ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = s.party_id) cust ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_014_A_SESSAO_SE_BUSCA_UMA_A_UMA = `-- O atendimento entra na fila UM A UM, n\xE3o a tabela inteira.
+--
+-- A vista buscava a sess\xE3o de cada consumo com um LEFT JOIN comum. Sob RLS
+-- isso \xE9 caro de um jeito que n\xE3o aparece no EXPLAIN de quem tem chave de
+-- servi\xE7o: a pol\xEDtica de \`plg_clinical_sessions\` chama \`app.has_unit\` e
+-- \`app.has_permission\` POR LINHA, e o planejador varre a tabela inteira antes
+-- de casar com os poucos consumos da janela. Medido aqui: 232.264 chamadas,
+-- 6,4 s \u2014 e a tela voltava \`canceling statement due to statement timeout\` com
+-- a janela de 30 dias j\xE1 aplicada.
+--
+-- LATERAL amarra a busca \xE0 linha de fora: a sess\xE3o \xE9 procurada pela chave
+-- (tenant, id) uma vez por consumo, e a RLS roda dezenas de vezes em vez de
+-- centenas de milhares. \xC9 a mesma corre\xE7\xE3o que a 012 j\xE1 tinha feito para
+-- \`items\`, \`orders\` e \`people\` \u2014 a sess\xE3o tinha ficado de fora.
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            perf.name AS performed_by_name,
+            o.party_id AS customer_id,
+            cust.name AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            COALESCE(timezone('UTC', cs.executed_on::timestamp), cs.created_at) AS used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            perf.name AS performed_by_name,
+            s.party_id AS customer_id,
+            cust.name AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN LATERAL ( SELECT ss.party_id, ss.performed_by_id, ss.assignee_id, ss.service_id
+                   FROM plg_clinical_sessions ss
+                  WHERE ss.tenant_id = cs.tenant_id AND ss.id = cs.session_id) s ON true
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id) o ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id)) perf ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = s.party_id) cust ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_015_LATERAL_SEM_CERCA_NAO_E_LATERAL = `-- LATERAL sem cerca n\xE3o \xE9 LATERAL.
+--
+-- A 012 e a 014 escreveram as buscas de \`items\`, \`orders\`, \`people\` e da
+-- sess\xE3o como LATERAL para que cada uma rodasse por linha. O planejador
+-- desfez o gesto: subconsulta simples \xE9 ACHATADA de volta a jun\xE7\xE3o comum, e o
+-- plano voltava a varrer \`people\` inteira (61.854 linhas) e a sess\xE3o inteira.
+-- Sob RLS cada uma dessas linhas paga \`app.has_unit\` + \`app.has_permission\`,
+-- e a tela morria nos 8 s do PostgREST.
+--
+-- \`LIMIT 1\` \xE9 a cerca: o Postgres n\xE3o achata subconsulta com limite. A chave
+-- \xE9 \xFAnica nos quatro casos, ent\xE3o o limite n\xE3o muda resultado nenhum \u2014 s\xF3
+-- impede que a busca de UMA linha vire uma varredura de todas.
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            perf.name AS performed_by_name,
+            o.party_id AS customer_id,
+            cust.name AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            COALESCE(timezone('UTC', cs.executed_on::timestamp), cs.created_at) AS used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            perf.name AS performed_by_name,
+            s.party_id AS customer_id,
+            cust.name AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN LATERAL ( SELECT ss.party_id, ss.performed_by_id, ss.assignee_id, ss.service_id
+                   FROM plg_clinical_sessions ss
+                  WHERE ss.tenant_id = cs.tenant_id AND ss.id = cs.session_id LIMIT 1) s ON true
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id LIMIT 1) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id LIMIT 1) o ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) LIMIT 1) perf ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = s.party_id LIMIT 1) cust ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_016_A_DATA_DO_CONSUMO_E_UMA_COLUNA = `-- A data do consumo passa a ser uma COLUNA, e por isso a janela usa \xEDndice.
+--
+-- Sob RLS o Postgres roda as regras da pol\xEDtica ANTES das condi\xE7\xF5es de quem
+-- pergunta \u2014 a n\xE3o ser que a condi\xE7\xE3o seja \`leakproof\`. A janela da fila
+-- (\`used_at >= agora - 30 dias\`) era uma EXPRESS\xC3O com \`timezone()\`, que n\xE3o \xE9
+-- leakproof: o \xEDndice da 013 existia e o plano o ignorava, varrendo as 116.934
+-- linhas e chamando \`app.has_unit\` 116.028 vezes. Medido: 7,9 s, e a tela
+-- morria nos 8 s do PostgREST.
+--
+-- Coluna gerada e gravada resolve pela raiz: a compara\xE7\xE3o vira \`coluna >=
+-- constante\`, que \xE9 leakproof, entra como condi\xE7\xE3o de \xEDndice e a RLS passa a
+-- rodar sobre as dezenas de linhas da janela em vez da tabela inteira. O valor
+-- \xE9 o mesmo de antes (o cluster roda em UTC), calculado uma vez na escrita.
+
+ALTER TABLE public.plg_clinical_session_products
+  ADD COLUMN IF NOT EXISTS used_at timestamptz
+  GENERATED ALWAYS AS (COALESCE(timezone('UTC', executed_on::timestamp), created_at)) STORED;
+
+DROP INDEX IF EXISTS public.plg_clinical_session_products_used_at_idx;
+CREATE INDEX IF NOT EXISTS plg_clinical_session_products_used_at_idx
+  ON public.plg_clinical_session_products (tenant_id, used_at DESC);
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            perf.name AS performed_by_name,
+            o.party_id AS customer_id,
+            cust.name AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            cs.used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            perf.name AS performed_by_name,
+            s.party_id AS customer_id,
+            cust.name AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN LATERAL ( SELECT ss.party_id, ss.performed_by_id, ss.assignee_id, ss.service_id
+                   FROM plg_clinical_sessions ss
+                  WHERE ss.tenant_id = cs.tenant_id AND ss.id = cs.session_id LIMIT 1) s ON true
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id LIMIT 1) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id LIMIT 1) o ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) LIMIT 1) perf ON true
+             LEFT JOIN LATERAL ( SELECT pe.id, pe.name
+                   FROM people pe
+                  WHERE pe.id = s.party_id LIMIT 1) cust ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_017_APROVAR_E_BAIXAR_SAO_DOIS_GESTOS = `-- Aprovar e baixar no estoque s\xE3o DOIS gestos, e faltavam os dois.
+--
+-- A fila da Auditoria de Uso existe desde o come\xE7o deste porte: o injetor
+-- lan\xE7a o que usou, a linha chega aqui, e o estoquista confere. S\xF3 que a tela
+-- s\xF3 sabia CORRIGIR a quantidade \u2014 n\xE3o havia como aceitar. O consumo entrava
+-- na fila e o saldo nunca ca\xEDa. A pergunta que a jornada 4 do V1 responde
+-- ("executei e o estoque n\xE3o mudou") continuava sem resposta, porque o bot\xE3o
+-- que a responde n\xE3o existia.
+--
+-- O V1 tem tr\xEAs a\xE7\xF5es por linha, e elas s\xE3o diferentes de prop\xF3sito:
+--
+--     \u{1F4CD} Baixar no estoque   aceita E desconta do saldo
+--     \u270F\uFE0F Corrigir            conserta a quantidade digitada errada
+--     \u2705 Aprovar             aceita o consumo, sem mexer no saldo
+--
+-- "Aprovar" sem baixar existe para o consumo que n\xE3o sai do estoque da casa \u2014
+-- produto do pr\xF3prio cliente, amostra do fornecedor, item j\xE1 baixado por fora.
+--
+-- SOBRE SALDO NEGATIVO. Esta fun\xE7\xE3o N\xC3O exige saldo. O movimento \xE9 o registro
+-- do que foi usado numa pessoa, e isso aconteceu independentemente do que o
+-- sistema achava que havia na prateleira. Recusar a baixa por falta de saldo
+-- esconderia o consumo e deixaria a diferen\xE7a invis\xEDvel; deixar o saldo ficar
+-- negativo \xE9 exatamente o sinal que o estoquista precisa ver.
+
+CREATE OR REPLACE FUNCTION public.inventory_approve_usage_batch(
+  p_lines jsonb,
+  p_post boolean DEFAULT false,
+  p_reason text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $fn$
+DECLARE
+  v_tenant    uuid := app.inventory_require_tenant();
+  v_actor     uuid := auth.uid();
+  v_key       text;
+  v_op        record;
+  r           record;
+  v_cs        record;
+  v_location  uuid;
+  v_cost      numeric;
+  v_movement  uuid;
+  v_no        integer := 0;
+  v_aprovadas integer := 0;
+  v_baixadas  integer := 0;
+  v_puladas   integer := 0;
+  v_movements jsonb := '[]'::jsonb;
+BEGIN
+  PERFORM app.inventory_check_lines(p_lines);
+
+  SELECT 'usage_audit_approve:' || CASE WHEN p_post THEN 'post:' ELSE 'ack:' END
+         || md5(string_agg((l->>'item_id'), ',' ORDER BY (l->>'item_id')))
+    INTO v_key
+    FROM jsonb_array_elements(p_lines) AS l;
+
+  SELECT * INTO v_op FROM app.inventory_begin_operation(
+    -- \`confirm\` \xE9 a opera\xE7\xE3o de quem TIRA do estoque por consumo \u2014 o mesmo
+    -- verbo que o consumo de item de pedido usa. 'out' n\xE3o existe no cat\xE1logo
+    -- de opera\xE7\xF5es (s\xF3 de movimentos), e o CHECK recusava.
+    v_tenant, CASE WHEN p_post THEN 'confirm' ELSE 'adjust' END, v_key,
+    jsonb_build_object('source', 'usage_audit_approve', 'post', p_post, 'lines', p_lines));
+  IF v_op.existing IS NOT NULL THEN
+    RETURN v_op.existing;
+  END IF;
+
+  FOR r IN
+    SELECT (l->>'item_id')::uuid AS item_id, ord
+      FROM jsonb_array_elements(p_lines) WITH ORDINALITY AS t(l, ord)
+     ORDER BY ord
+  LOOP
+    v_no := v_no + 1;
+
+    SELECT cs.* INTO v_cs
+      FROM public.plg_clinical_session_products cs
+     WHERE cs.tenant_id = v_tenant AND cs.id = r.item_id
+     FOR UPDATE;
+
+    -- Linha que n\xE3o \xE9 consumo cl\xEDnico j\xE1 nasceu como movimento do raz\xE3o: ela
+    -- n\xE3o tem o que aprovar, e some da fila por outro caminho.
+    IF NOT FOUND THEN
+      v_puladas := v_puladas + 1;
+      CONTINUE;
+    END IF;
+
+    IF p_post AND coalesce(v_cs.used_quantity, 0) > 0 THEN
+      -- ONDE A BAIXA ACONTECE. Prefer\xEAncia: o local padr\xE3o do produto na
+      -- unidade, depois o da ficha, depois o primeiro local ativo dela.
+      SELECT candidate.location_id INTO v_location
+        FROM (
+          SELECT s.default_location_id AS location_id,
+                 CASE WHEN v_cs.unit_id IS NOT NULL AND s.unit_id = v_cs.unit_id THEN 1 ELSE 2 END AS priority
+            FROM public.plg_inventory_product_settings s
+           WHERE s.tenant_id = v_tenant
+             AND s.product_id = v_cs.product_id
+             AND s.default_location_id IS NOT NULL
+             AND (s.unit_id IS NULL OR s.unit_id = v_cs.unit_id)
+          UNION ALL
+          SELECT d.default_location_id, 3
+            FROM public.plg_inventory_product_details d
+           WHERE d.tenant_id = v_tenant
+             AND d.product_id = v_cs.product_id
+             AND d.default_location_id IS NOT NULL
+          UNION ALL
+          SELECT l.id, 4
+            FROM public.plg_inventory_stock_locations l
+           WHERE l.tenant_id = v_tenant AND l.is_active
+        ) candidate
+        JOIN public.plg_inventory_stock_locations l
+          ON l.id = candidate.location_id AND l.tenant_id = v_tenant AND l.is_active
+       WHERE v_cs.unit_id IS NULL OR l.unit_id = v_cs.unit_id OR l.unit_id IS NULL
+       ORDER BY candidate.priority, l.created_at, l.id
+       LIMIT 1;
+
+      IF v_location IS NULL THEN
+        RAISE EXCEPTION 'inventory: nenhum local de estoque ativo para a unidade deste consumo'
+          USING ERRCODE = '22023';
+      END IF;
+
+      SELECT p.unit_cost INTO v_cost
+        FROM public.plg_inventory_stock_positions p
+       WHERE p.tenant_id = v_tenant AND p.product_id = v_cs.product_id
+         AND p.stock_location_id = v_location
+       ORDER BY p.expiration_date NULLS LAST, p.created_at
+       LIMIT 1;
+
+      INSERT INTO public.plg_inventory_stock_movements
+        (tenant_id, unit_id, product_id, kind, quantity, unit_cost, source_location_id,
+         measurement_unit_id, document_type, document_number,
+         source_item_type, source_item_id, idempotency_key, line_no, operation_id,
+         user_id, metadata)
+      VALUES
+        (v_tenant, v_cs.unit_id, v_cs.product_id, 'out', -v_cs.used_quantity,
+         coalesce(v_cost, 0), v_location, v_cs.used_unit_id, 'consumption',
+         coalesce(v_cs.session_id::text, v_cs.id::text),
+         'usage_audit', v_cs.id, v_key, v_no, v_op.op_id, v_actor,
+         jsonb_strip_nulls(jsonb_build_object(
+           'source', 'usage_audit_approve',
+           'session_id', v_cs.session_id,
+           'order_item_id', v_cs.order_item_id,
+           'reason', nullif(btrim(p_reason), ''))))
+      RETURNING id INTO v_movement;
+
+      v_movements := v_movements || app.inventory_movement_json(v_movement);
+      v_baixadas := v_baixadas + 1;
+    END IF;
+
+    -- CONFERIDO \xE9 o mesmo carimbo nos dois gestos: o que sai da fila \xE9 o que
+    -- algu\xE9m olhou, tenha ou n\xE3o baixado.
+    UPDATE public.plg_clinical_session_products cs
+       SET is_audited = true,
+           audited_at = now(),
+           audited_by = coalesce(cs.audited_by, v_actor),
+           audit_notes = coalesce(nullif(btrim(p_reason), ''), cs.audit_notes),
+           updated_at = now()
+     WHERE cs.id = v_cs.id;
+    v_aprovadas := v_aprovadas + 1;
+  END LOOP;
+
+  RETURN app.inventory_finish_operation(
+    v_tenant, v_op.op_id, CASE WHEN p_post THEN 'confirm' ELSE 'adjust' END, v_key,
+    jsonb_build_object(
+      'operation_id', v_op.op_id, 'kind', 'usage_audit_approve',
+      'idempotency_key', v_key, 'status', CASE WHEN p_post THEN 'posted' ELSE 'approved' END,
+      'lines_approved', v_aprovadas, 'lines_posted', v_baixadas,
+      'lines_skipped', v_puladas, 'movements', v_movements),
+    jsonb_build_object('source', 'usage_audit_approve', 'post', p_post,
+      'lines_approved', v_aprovadas, 'lines_posted', v_baixadas));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.inventory_approve_usage_batch(jsonb, boolean, text) TO authenticated;
+`;
+var MIGRATION_018_O_NOME_NAO_SAI_DA_VISTA = `-- O NOME N\xC3O SAI DA VISTA. A vista devolve o id; quem pinta busca o nome.
+--
+-- \`people\` tem 120.379 linhas neste tenant e uma pol\xEDtica de RLS que passa por
+-- \`resource_grants\`. Buscar o nome do profissional e o da cliente DENTRO da
+-- vista fazia essa pol\xEDtica rodar linha a linha: a mesma consulta que custa
+-- 9 ms com chave de servi\xE7o levava **30 segundos** com a sess\xE3o de quem usa a
+-- tela, e o PostgREST desistia aos 8.
+--
+-- Nenhum \xEDndice conserta isso, porque o problema n\xE3o \xE9 achar a pessoa \u2014 \xE9 a
+-- pol\xEDtica ser avaliada uma vez por candidato. A sa\xEDda \xE9 n\xE3o perguntar ali: a
+-- vista entrega \`performed_by_id\` e \`customer_id\`, e a tela busca os ~50 nomes
+-- de uma vez, numa consulta s\xF3, com a RLS rodando uma vez para todos.
+
+CREATE OR REPLACE VIEW public.v_inventory_consumption_audit WITH (security_invoker = true) AS
+ WITH consumed AS (
+         SELECT m.tenant_id,
+            m.unit_id,
+            m.source_item_id AS item_id,
+            m.product_id,
+            sum(- m.quantity) AS posted_quantity,
+            sum(m.total_cost) AS total_cost,
+            min(m.created_at) AS used_at,
+            min(m.movement_date) AS movement_date,
+            (array_agg(m.source_location_id ORDER BY m.created_at, m.id))[1] AS stock_location_id,
+            count(DISTINCT m.source_location_id)::integer AS location_count,
+            (array_agg(m.measurement_unit_id ORDER BY m.created_at, m.id))[1] AS measurement_unit_id,
+            (array_agg(m.metadata ->> 'recipe_id'::text ORDER BY m.created_at, m.id))[1] AS recipe_id
+           FROM plg_inventory_stock_movements m
+          WHERE m.source_item_type = 'order_item'::text AND m.source_item_id IS NOT NULL AND m.kind = 'out'::text AND NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements r
+                  WHERE r.reverses_movement_id = m.id))
+          GROUP BY m.tenant_id, m.unit_id, m.source_item_id, m.product_id
+        ), corrected AS (
+         SELECT c.tenant_id,
+            c.source_item_id AS item_id,
+            c.product_id,
+            sum(- c.quantity) AS correction_delta,
+            sum((- sign(c.quantity)) * c.total_cost) AS correction_cost,
+            max(c.created_at) AS corrected_at,
+            (array_agg(c.reason ORDER BY c.created_at DESC, c.id DESC))[1] AS correction_reason
+           FROM plg_inventory_stock_movements c
+          WHERE c.source_item_type = 'usage_audit'::text AND c.source_item_id IS NOT NULL
+          GROUP BY c.tenant_id, c.source_item_id, c.product_id
+        ), ledger AS (
+         SELECT c.tenant_id,
+            c.unit_id,
+            c.item_id,
+            c.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            c.used_at,
+            c.movement_date,
+            c.posted_quantity,
+            c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) AS net_quantity,
+            std.standard_quantity,
+                CASE
+                    WHEN std.standard_quantity IS NULL THEN NULL::numeric
+                    ELSE c.posted_quantity + COALESCE(k.correction_delta, 0::numeric) - std.standard_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            c.total_cost + COALESCE(k.correction_cost, 0::numeric) AS total_cost,
+            c.stock_location_id,
+            sl.name AS stock_location_name,
+            c.location_count,
+            r.id AS recipe_id,
+            r.name AS recipe_name,
+            i.order_id,
+            i.name AS item_name,
+            o.reference_number AS order_reference,
+            i.assignee_id AS performed_by_id,
+            NULL::text AS performed_by_name,
+            o.party_id AS customer_id,
+            NULL::text AS customer_name,
+            k.corrected_at,
+            k.correction_reason,
+            k.item_id IS NOT NULL AS is_corrected,
+            'ledger'::text AS source,
+            true AS stock_posted
+           FROM consumed c
+             LEFT JOIN corrected k ON k.tenant_id = c.tenant_id AND k.item_id = c.item_id AND k.product_id = c.product_id
+             LEFT JOIN products p ON p.id = c.product_id
+             LEFT JOIN plg_inventory_stock_locations sl ON sl.id = c.stock_location_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = c.measurement_unit_id
+             LEFT JOIN items i ON i.id = c.item_id AND i.tenant_id = c.tenant_id
+             LEFT JOIN orders o ON o.id = i.order_id
+             LEFT JOIN people perf ON perf.id = i.assignee_id
+             LEFT JOIN people cust ON cust.id = o.party_id
+             LEFT JOIN plg_inventory_recipes r ON r.id = NULLIF(c.recipe_id, ''::text)::uuid AND r.tenant_id = c.tenant_id
+             LEFT JOIN LATERAL ( SELECT
+                        CASE
+                            WHEN r.id IS NOT NULL AND COALESCE(r.yield_quantity, 0::numeric) > 0::numeric THEN ( SELECT round(sum(ri.quantity) * COALESCE(i.quantity, 1::numeric) / r.yield_quantity, 4) AS round
+                               FROM plg_inventory_recipe_ingredients ri
+                              WHERE ri.tenant_id = c.tenant_id AND ri.recipe_id = r.id AND ri.product_id = c.product_id)
+                            WHEN r.id IS NULL THEN i.quantity
+                            ELSE NULL::numeric
+                        END AS standard_quantity) std ON true
+        ), clinical AS (
+         SELECT cs.tenant_id,
+            cs.unit_id,
+            cs.id AS item_id,
+            cs.product_id,
+            p.name AS product_name,
+            p.sku AS product_sku,
+            cs.used_at,
+            COALESCE(cs.executed_on, cs.created_at::date) AS movement_date,
+            COALESCE(cs.used_quantity, 0::numeric) AS posted_quantity,
+            COALESCE(cs.used_quantity, 0::numeric) AS net_quantity,
+            NULLIF(cs.default_quantity, 0::numeric) AS standard_quantity,
+                CASE
+                    WHEN NULLIF(cs.default_quantity, 0::numeric) IS NULL THEN NULL::numeric
+                    ELSE COALESCE(cs.used_quantity, 0::numeric) - cs.default_quantity
+                END AS variance,
+            u.abbreviation AS unit_abbreviation,
+            0::numeric AS total_cost,
+            NULL::uuid AS stock_location_id,
+            NULL::text AS stock_location_name,
+            1 AS location_count,
+            NULL::uuid AS recipe_id,
+            NULL::text AS recipe_name,
+            i.order_id,
+            sv.name AS item_name,
+            o.reference_number AS order_reference,
+            COALESCE(cs.assignee_id, s.performed_by_id, s.assignee_id) AS performed_by_id,
+            NULL::text AS performed_by_name,
+            s.party_id AS customer_id,
+            NULL::text AS customer_name,
+            cs.audited_at AS corrected_at,
+            cs.audit_notes AS correction_reason,
+            cs.is_audited AS is_corrected,
+            'clinical'::text AS source,
+            false AS stock_posted
+           FROM plg_clinical_session_products cs
+             LEFT JOIN LATERAL ( SELECT ss.party_id, ss.performed_by_id, ss.assignee_id, ss.service_id
+                   FROM plg_clinical_sessions ss
+                  WHERE ss.tenant_id = cs.tenant_id AND ss.id = cs.session_id LIMIT 1) s ON true
+             LEFT JOIN products p ON p.id = cs.product_id
+             LEFT JOIN products sv ON sv.id = s.service_id
+             LEFT JOIN plg_inventory_measurement_units u ON u.id = cs.used_unit_id
+             LEFT JOIN LATERAL ( SELECT it.id, it.order_id, it.name, it.assignee_id
+                   FROM items it
+                  WHERE cs.order_item_id IS NOT NULL
+                    AND it.id = cs.order_item_id AND it.tenant_id = cs.tenant_id LIMIT 1) i ON true
+             LEFT JOIN LATERAL ( SELECT ord.id, ord.reference_number, ord.party_id
+                   FROM orders ord
+                  WHERE i.order_id IS NOT NULL AND ord.id = i.order_id LIMIT 1) o ON true
+          WHERE NOT (EXISTS ( SELECT 1
+                   FROM plg_inventory_stock_movements m
+                  WHERE m.tenant_id = cs.tenant_id AND m.source_item_type = 'order_item'::text AND m.source_item_id = cs.order_item_id AND m.product_id = cs.product_id AND m.kind = 'out'::text))
+        )
+ SELECT tenant_id,
+    unit_id,
+    item_id,
+    product_id,
+    product_name,
+    product_sku,
+    used_at,
+    movement_date,
+    posted_quantity::numeric(14,4) AS posted_quantity,
+    net_quantity::numeric(14,4) AS net_quantity,
+    standard_quantity::numeric(14,4) AS standard_quantity,
+    variance,
+    unit_abbreviation,
+    total_cost::numeric(16,4) AS total_cost,
+    stock_location_id,
+    stock_location_name,
+    location_count,
+    recipe_id,
+    recipe_name,
+    order_id,
+    item_name,
+    order_reference,
+    performed_by_id,
+    performed_by_name,
+    customer_id,
+    customer_name,
+    corrected_at,
+    correction_reason,
+    is_corrected,
+    source,
+    stock_posted
+   FROM ( SELECT ledger.tenant_id,
+            ledger.unit_id,
+            ledger.item_id,
+            ledger.product_id,
+            ledger.product_name,
+            ledger.product_sku,
+            ledger.used_at,
+            ledger.movement_date,
+            ledger.posted_quantity,
+            ledger.net_quantity,
+            ledger.standard_quantity,
+            ledger.variance,
+            ledger.unit_abbreviation,
+            ledger.total_cost,
+            ledger.stock_location_id,
+            ledger.stock_location_name,
+            ledger.location_count,
+            ledger.recipe_id,
+            ledger.recipe_name,
+            ledger.order_id,
+            ledger.item_name,
+            ledger.order_reference,
+            ledger.performed_by_id,
+            ledger.performed_by_name,
+            ledger.customer_id,
+            ledger.customer_name,
+            ledger.corrected_at,
+            ledger.correction_reason,
+            ledger.is_corrected,
+            ledger.source,
+            ledger.stock_posted
+           FROM ledger
+        UNION ALL
+         SELECT clinical.tenant_id,
+            clinical.unit_id,
+            clinical.item_id,
+            clinical.product_id,
+            clinical.product_name,
+            clinical.product_sku,
+            clinical.used_at,
+            clinical.movement_date,
+            clinical.posted_quantity,
+            clinical.net_quantity,
+            clinical.standard_quantity,
+            clinical.variance,
+            clinical.unit_abbreviation,
+            clinical.total_cost,
+            clinical.stock_location_id,
+            clinical.stock_location_name,
+            clinical.location_count,
+            clinical.recipe_id,
+            clinical.recipe_name,
+            clinical.order_id,
+            clinical.item_name,
+            clinical.order_reference,
+            clinical.performed_by_id,
+            clinical.performed_by_name,
+            clinical.customer_id,
+            clinical.customer_name,
+            clinical.corrected_at,
+            clinical.correction_reason,
+            clinical.is_corrected,
+            clinical.source,
+            clinical.stock_posted
+           FROM clinical) a;;
+`;
+var MIGRATION_019_SEM_SALDO_NAO_SE_BAIXA = `-- Sem saldo n\xE3o se baixa \u2014 e a fila diz qual produto faltou.
+--
+-- A 017 assumiu que a baixa sempre cabe. N\xE3o cabe: o gatilho de posi\xE7\xE3o da
+-- plataforma recusa sa\xEDda sem lastro, e o estoque deste tenant est\xE1 zerado em
+-- 223 dos 225 produtos. O clique voltava com o erro cru do Postgres
+-- ("insufficient stock (no position for product \u2026)") e a linha sumia do
+-- alcance de quem tentou.
+--
+-- Agora a linha sem saldo \xE9 SEPARADA: n\xE3o \xE9 baixada, n\xE3o \xE9 carimbada como
+-- conferida \u2014 continua pendente, que \xE9 o estado certo enquanto a entrada n\xE3o
+-- for dada \u2014, e volta com nome de produto, quanto precisa e quanto h\xE1.
+
+CREATE OR REPLACE FUNCTION public.inventory_approve_usage_batch(
+  p_lines jsonb,
+  p_post boolean DEFAULT false,
+  p_reason text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $fn$
+DECLARE
+  v_tenant    uuid := app.inventory_require_tenant();
+  v_actor     uuid := auth.uid();
+  v_key       text;
+  v_op        record;
+  r           record;
+  v_cs        record;
+  v_location  uuid;
+  v_cost      numeric;
+  v_movement  uuid;
+  v_no        integer := 0;
+  v_aprovadas integer := 0;
+  v_baixadas  integer := 0;
+  v_puladas   integer := 0;
+  v_sem_saldo integer := 0;
+  v_faltando  jsonb := '[]'::jsonb;
+  v_disp      numeric;
+  v_movements jsonb := '[]'::jsonb;
+BEGIN
+  PERFORM app.inventory_check_lines(p_lines);
+
+  SELECT 'usage_audit_approve:' || CASE WHEN p_post THEN 'post:' ELSE 'ack:' END
+         || md5(string_agg((l->>'item_id'), ',' ORDER BY (l->>'item_id')))
+    INTO v_key
+    FROM jsonb_array_elements(p_lines) AS l;
+
+  SELECT * INTO v_op FROM app.inventory_begin_operation(
+    -- \`confirm\` \xE9 a opera\xE7\xE3o de quem TIRA do estoque por consumo \u2014 o mesmo
+    -- verbo que o consumo de item de pedido usa. 'out' n\xE3o existe no cat\xE1logo
+    -- de opera\xE7\xF5es (s\xF3 de movimentos), e o CHECK recusava.
+    v_tenant, CASE WHEN p_post THEN 'confirm' ELSE 'adjust' END, v_key,
+    jsonb_build_object('source', 'usage_audit_approve', 'post', p_post, 'lines', p_lines));
+  IF v_op.existing IS NOT NULL THEN
+    RETURN v_op.existing;
+  END IF;
+
+  FOR r IN
+    SELECT (l->>'item_id')::uuid AS item_id, ord
+      FROM jsonb_array_elements(p_lines) WITH ORDINALITY AS t(l, ord)
+     ORDER BY ord
+  LOOP
+    v_no := v_no + 1;
+
+    SELECT cs.* INTO v_cs
+      FROM public.plg_clinical_session_products cs
+     WHERE cs.tenant_id = v_tenant AND cs.id = r.item_id
+     FOR UPDATE;
+
+    -- Linha que n\xE3o \xE9 consumo cl\xEDnico j\xE1 nasceu como movimento do raz\xE3o: ela
+    -- n\xE3o tem o que aprovar, e some da fila por outro caminho.
+    IF NOT FOUND THEN
+      v_puladas := v_puladas + 1;
+      CONTINUE;
+    END IF;
+
+    IF p_post AND coalesce(v_cs.used_quantity, 0) > 0 THEN
+      -- ONDE A BAIXA ACONTECE. Prefer\xEAncia: o local padr\xE3o do produto na
+      -- unidade, depois o da ficha, depois o primeiro local ativo dela.
+      SELECT candidate.location_id INTO v_location
+        FROM (
+          SELECT s.default_location_id AS location_id,
+                 CASE WHEN v_cs.unit_id IS NOT NULL AND s.unit_id = v_cs.unit_id THEN 1 ELSE 2 END AS priority
+            FROM public.plg_inventory_product_settings s
+           WHERE s.tenant_id = v_tenant
+             AND s.product_id = v_cs.product_id
+             AND s.default_location_id IS NOT NULL
+             AND (s.unit_id IS NULL OR s.unit_id = v_cs.unit_id)
+          UNION ALL
+          SELECT d.default_location_id, 3
+            FROM public.plg_inventory_product_details d
+           WHERE d.tenant_id = v_tenant
+             AND d.product_id = v_cs.product_id
+             AND d.default_location_id IS NOT NULL
+          UNION ALL
+          SELECT l.id, 4
+            FROM public.plg_inventory_stock_locations l
+           WHERE l.tenant_id = v_tenant AND l.is_active
+        ) candidate
+        JOIN public.plg_inventory_stock_locations l
+          ON l.id = candidate.location_id AND l.tenant_id = v_tenant AND l.is_active
+       WHERE v_cs.unit_id IS NULL OR l.unit_id = v_cs.unit_id OR l.unit_id IS NULL
+       ORDER BY candidate.priority, l.created_at, l.id
+       LIMIT 1;
+
+      IF v_location IS NULL THEN
+        RAISE EXCEPTION 'inventory: nenhum local de estoque ativo para a unidade deste consumo'
+          USING ERRCODE = '22023';
+      END IF;
+
+      -- SEM SALDO N\xC3O SE BAIXA, e quem clicou precisa saber por qu\xEA.
+      --
+      -- A plataforma n\xE3o deixa o saldo ficar negativo: o gatilho de posi\xE7\xE3o
+      -- recusa a sa\xEDda sem lastro. Em vez de devolver o erro cru do banco, a
+      -- linha \xE9 separada e volta nomeada \u2014 a fila mant\xE9m o consumo pendente,
+      -- que \xE9 o estado certo enquanto a entrada n\xE3o for dada.
+      SELECT coalesce(sum(p.quantity), 0) INTO v_disp
+        FROM public.plg_inventory_stock_positions p
+       WHERE p.tenant_id = v_tenant AND p.product_id = v_cs.product_id
+         AND p.stock_location_id = v_location;
+
+      IF coalesce(v_disp, 0) < v_cs.used_quantity THEN
+        v_sem_saldo := v_sem_saldo + 1;
+        v_faltando := v_faltando || jsonb_build_array(jsonb_build_object(
+          'item_id', v_cs.id,
+          'product', (SELECT pr.name FROM public.products pr WHERE pr.id = v_cs.product_id),
+          'needed', v_cs.used_quantity,
+          'available', coalesce(v_disp, 0)));
+        CONTINUE;
+      END IF;
+
+      SELECT p.unit_cost INTO v_cost
+        FROM public.plg_inventory_stock_positions p
+       WHERE p.tenant_id = v_tenant AND p.product_id = v_cs.product_id
+         AND p.stock_location_id = v_location
+       ORDER BY p.expiration_date NULLS LAST, p.created_at
+       LIMIT 1;
+
+      INSERT INTO public.plg_inventory_stock_movements
+        (tenant_id, unit_id, product_id, kind, quantity, unit_cost, source_location_id,
+         measurement_unit_id, document_type, document_number,
+         source_item_type, source_item_id, idempotency_key, line_no, operation_id,
+         user_id, metadata)
+      VALUES
+        (v_tenant, v_cs.unit_id, v_cs.product_id, 'out', -v_cs.used_quantity,
+         coalesce(v_cost, 0), v_location, v_cs.used_unit_id, 'consumption',
+         coalesce(v_cs.session_id::text, v_cs.id::text),
+         'usage_audit', v_cs.id, v_key, v_no, v_op.op_id, v_actor,
+         jsonb_strip_nulls(jsonb_build_object(
+           'source', 'usage_audit_approve',
+           'session_id', v_cs.session_id,
+           'order_item_id', v_cs.order_item_id,
+           'reason', nullif(btrim(p_reason), ''))))
+      RETURNING id INTO v_movement;
+
+      v_movements := v_movements || app.inventory_movement_json(v_movement);
+      v_baixadas := v_baixadas + 1;
+    END IF;
+
+    -- CONFERIDO \xE9 o mesmo carimbo nos dois gestos: o que sai da fila \xE9 o que
+    -- algu\xE9m olhou, tenha ou n\xE3o baixado.
+    UPDATE public.plg_clinical_session_products cs
+       SET is_audited = true,
+           audited_at = now(),
+           audited_by = coalesce(cs.audited_by, v_actor),
+           audit_notes = coalesce(nullif(btrim(p_reason), ''), cs.audit_notes),
+           updated_at = now()
+     WHERE cs.id = v_cs.id;
+    v_aprovadas := v_aprovadas + 1;
+  END LOOP;
+
+  RETURN app.inventory_finish_operation(
+    v_tenant, v_op.op_id, CASE WHEN p_post THEN 'confirm' ELSE 'adjust' END, v_key,
+    jsonb_build_object(
+      'operation_id', v_op.op_id, 'kind', 'usage_audit_approve',
+      'idempotency_key', v_key, 'status', CASE WHEN p_post THEN 'posted' ELSE 'approved' END,
+      'lines_approved', v_aprovadas, 'lines_posted', v_baixadas,
+      'lines_skipped', v_puladas, 'lines_no_stock', v_sem_saldo,
+      'missing', v_faltando, 'movements', v_movements),
+    jsonb_build_object('source', 'usage_audit_approve', 'post', p_post,
+      'lines_approved', v_aprovadas, 'lines_posted', v_baixadas,
+      'lines_no_stock', v_sem_saldo));
+END $fn$;
+
+GRANT EXECUTE ON FUNCTION public.inventory_approve_usage_batch(jsonb, boolean, text) TO authenticated;
+`;
 var MIGRATIONS = [
   { id: "000_baseline", sql: MIGRATION_000_BASELINE },
   { id: "001_the_usage_that_left_stock_can_be_audited", sql: MIGRATION_001_THE_USAGE_THAT_LEFT_STOCK_CAN_BE_AUDITED },
   { id: "002_a_auditoria_fecha_em_lote", sql: MIGRATION_002_A_AUDITORIA_FECHA_EM_LOTE },
   { id: "003_stock_count_closes_through_ledger", sql: MIGRATION_003_STOCK_COUNT_CLOSES_THROUGH_LEDGER },
   { id: "004_a_posicao_de_estoque_atravessa", sql: MIGRATION_004_A_POSICAO_DE_ESTOQUE_ATRAVESSA },
-  { id: "005_a_posicao_e_consequencia_do_movimento", sql: MIGRATION_005_A_POSICAO_E_CONSEQUENCIA_DO_MOVIMENTO }
+  { id: "005_a_posicao_e_consequencia_do_movimento", sql: MIGRATION_005_A_POSICAO_E_CONSEQUENCIA_DO_MOVIMENTO },
+  { id: "006_a_producao_tem_ordem_e_estacao", sql: MIGRATION_006_A_PRODUCAO_TEM_ORDEM_E_ESTACAO },
+  { id: "007_a_producao_atravessa", sql: MIGRATION_007_A_PRODUCAO_ATRAVESSA },
+  { id: "008_o_grupo_da_receita_tambem_e_de_uma_casa", sql: MIGRATION_008_O_GRUPO_DA_RECEITA_TAMBEM_E_DE_UMA_CASA },
+  { id: "009_a_direcao_do_movimento_nao_esta_no_numero", sql: MIGRATION_009_A_DIRECAO_DO_MOVIMENTO_NAO_ESTA_NO_NUMERO },
+  { id: "010_a_entrada_de_notas_atravessa", sql: MIGRATION_010_A_ENTRADA_DE_NOTAS_ATRAVESSA },
+  { id: "011_o_consumo_tem_duas_origens", sql: MIGRATION_011_O_CONSUMO_TEM_DUAS_ORIGENS },
+  { id: "012_o_consumo_clinico_nao_precisa_da_tabela_de_itens_inteira", sql: MIGRATION_012_O_CONSUMO_CLINICO_NAO_PRECISA_DA_TABELA_DE_ITENS_INTEIRA },
+  { id: "013_a_fila_de_auditoria_tem_uma_janela", sql: MIGRATION_013_A_FILA_DE_AUDITORIA_TEM_UMA_JANELA },
+  { id: "014_a_sessao_se_busca_uma_a_uma", sql: MIGRATION_014_A_SESSAO_SE_BUSCA_UMA_A_UMA },
+  { id: "015_lateral_sem_cerca_nao_e_lateral", sql: MIGRATION_015_LATERAL_SEM_CERCA_NAO_E_LATERAL },
+  { id: "016_a_data_do_consumo_e_uma_coluna", sql: MIGRATION_016_A_DATA_DO_CONSUMO_E_UMA_COLUNA },
+  { id: "017_aprovar_e_baixar_sao_dois_gestos", sql: MIGRATION_017_APROVAR_E_BAIXAR_SAO_DOIS_GESTOS },
+  { id: "018_o_nome_nao_sai_da_vista", sql: MIGRATION_018_O_NOME_NAO_SAI_DA_VISTA },
+  { id: "019_sem_saldo_nao_se_baixa", sql: MIGRATION_019_SEM_SALDO_NAO_SE_BAIXA }
 ];
 
 // src/index.ts
@@ -11604,7 +15517,7 @@ function createInventoryPlugin(options) {
         component: (() => {
           const Tab = () => React3.createElement(PluginSettingsPanel, {
             title: config.labels.pageTitle,
-            generalSettings: React3.createElement(InventoryGeneralSettings),
+            generalSettings: React3.createElement(InventoryGeneralSettings, { config }),
             registries: inventoryRegistries,
             hostPluginId: "inventory",
             routeBase: "/settings/inventory"