@fayz-ai/plugin-scribe 0.12.2 → 0.12.4

package/dist/index.js

@@ -2652,297 +2652,180 @@ function ScribeHeaderAction({ labels, item, entityId }) {
 }
 
 // src/migrations/index.ts
-var MIGRATION_001_SCRIBE_BASE = `-- plugin-scribe 001: gravar um atendimento inteiro sem poder perd\xEA-lo.
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-scribe/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
 --
--- O problema que este schema resolve n\xE3o \xE9 "guardar \xE1udio". \xC9 que o profissional
--- aperta gravar, navega o app por 40 minutos, e QUALQUER coisa pode acontecer no
--- meio: reload, aba morta, wifi caindo, tampa fechando. Perder a consulta \xE9 uma
--- falha irrecuper\xE1vel \u2014 n\xE3o d\xE1 para pedir para o paciente repetir.
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
 --
--- Por isso o desenho n\xE3o tem "o arquivo da sess\xE3o". Tem um MANIFESTO: a sess\xE3o
--- \xE9 uma linha, e cada 30 segundos de \xE1udio \xE9 OUTRA linha que sobe sozinha e \xE9
--- transcrita sozinha. O que chegou, chegou. O cliente pode morrer entre dois
--- segmentos e o que j\xE1 subiu continua \xEDntegro e j\xE1 transcrito.
+-- This replaced 3 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
 --
--- ---------------------------------------------------------------------------
--- Duas dura\xE7\xF5es, e elas discordam de prop\xF3sito
--- ---------------------------------------------------------------------------
--- \`wall_duration_ms\` \xE9 o rel\xF3gio de parede que o browser reportou. Serve para o
--- cron\xF4metro na tela e para mais nada.
---
--- \`audio_duration_ms\` \xE9 SUM(segments.duration_ms) \u2014 soma do \xE1udio que de fato
--- existe, com a dura\xE7\xE3o vinda da resposta do STT, n\xE3o de um \`setInterval\`.
---
--- Elas divergem sempre que a aba congela: notebook dormindo por 10 minutos faz
--- o rel\xF3gio de parede contar a soneca inteira enquanto o MediaRecorder n\xE3o
--- emitiu um byte. Registro cl\xEDnico, medidor de cota e fatura usam a SEGUNDA.
--- Confundir as duas \xE9 cobrar do cliente pelo cochilo do notebook.
---
--- ---------------------------------------------------------------------------
--- O contador nunca \xE9 escrito pelo browser
--- ---------------------------------------------------------------------------
--- \`scribe_record_segment\` (se\xE7\xE3o 5) faz o upsert do segmento e RECALCULA os
--- contadores da sess\xE3o a partir da tabela de segmentos. Um cliente que sobe o
--- mesmo segmento duas vezes (replay depois de queda de rede) converge para o
--- mesmo n\xFAmero em vez de somar duas vezes.
-
--- ---------------------------------------------------------------------------
--- 1. sessions \u2014 o encontro
--- ---------------------------------------------------------------------------
--- \`id\` N\xC3O tem DEFAULT gen_random_uuid(). \xC9 gerado no cliente, antes do primeiro
--- byte, e usado como chave no IndexedDB e no caminho do Storage. Sem isso a
--- grava\xE7\xE3o teria que esperar um round-trip para saber onde escrever \u2014 e uma
--- grava\xE7\xE3o que depende da rede para COME\xC7AR j\xE1 nasce fr\xE1gil.
-CREATE TABLE IF NOT EXISTS public.plg_scribe_sessions (
-  id                uuid PRIMARY KEY,
-  tenant_id         uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-
-  -- O titular. SET NULL e n\xE3o CASCADE: apagar a pessoa n\xE3o pode apagar em
-  -- sil\xEAncio o registro do atendimento que aconteceu.
-  subject_id        uuid REFERENCES public.people(id) ON DELETE SET NULL,
-  context_kind      text NOT NULL DEFAULT 'person'
-    CHECK (context_kind IN ('person', 'appointment', 'standalone')),
-  appointment_id    uuid REFERENCES public.appointments(id) ON DELETE SET NULL,
-  owner_user_id     uuid NOT NULL,
-
-  status            text NOT NULL DEFAULT 'recording'
-    CHECK (status IN ('recording','paused','interrupted','uploading','transcribing',
-                      'ready','generating','completed','abandoned','failed')),
-  locale            text NOT NULL DEFAULT 'pt-BR',
-  mime_type         text,
-
-  started_at        timestamptz NOT NULL DEFAULT now(),
-  ended_at          timestamptz,
-  wall_duration_ms  integer NOT NULL DEFAULT 0,
-  audio_duration_ms integer NOT NULL DEFAULT 0,
-
-  segment_count             integer NOT NULL DEFAULT 0,
-  uploaded_segment_count    integer NOT NULL DEFAULT 0,
-  transcribed_segment_count integer NOT NULL DEFAULT 0,
-  transcript_chars          integer NOT NULL DEFAULT 0,
-
-  -- Base legal, carimbada antes do primeiro byte. "Quando" e "como" \xE9 o que se
-  -- prova depois; guardar isso na mesma linha da grava\xE7\xE3o \xE9 o que torna a prova
-  -- barata.
-  consent_at        timestamptz,
-  consent_mode      text CHECK (consent_mode IN ('verbal','written','implied_contract')),
-
-  -- Reten\xE7\xE3o: o \xE1udio some, a transcri\xE7\xE3o e o documento assinado ficam.
-  retention_until   date,
-  audio_deleted_at  timestamptz,
-
-  error             text,
-  metadata          jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at        timestamptz NOT NULL DEFAULT now(),
-  updated_at        timestamptz NOT NULL DEFAULT now()
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_scribe_generations (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    template_id uuid,
+    template_key text,
+    tab_order integer DEFAULT 0 NOT NULL,
+    title text,
+    status text DEFAULT 'pending'::text NOT NULL,
+    markdown text,
+    markdown_edited text,
+    facts jsonb,
+    model text,
+    prompt_version text,
+    input_tokens integer,
+    output_tokens integer,
+    error text,
+    document_id uuid,
+    created_by uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_generations_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'running'::text, 'ready'::text, 'failed'::text, 'committed'::text, 'discarded'::text])))
 );
-ALTER TABLE public.plg_scribe_sessions ENABLE ROW LEVEL SECURITY;
 
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_sessions_tenant
-  ON public.plg_scribe_sessions(tenant_id);
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_sessions_subject
-  ON public.plg_scribe_sessions(subject_id) WHERE subject_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_sessions_appointment
-  ON public.plg_scribe_sessions(appointment_id) WHERE appointment_id IS NOT NULL;
-
--- A consulta da recupera\xE7\xE3o: "este usu\xE1rio tem alguma sess\xE3o aberta?". Roda em
--- todo boot do app, ent\xE3o \xE9 \xEDndice parcial e n\xE3o varredura.
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_sessions_open
-  ON public.plg_scribe_sessions(tenant_id, owner_user_id, status)
-  WHERE status IN ('recording','paused','interrupted','uploading','transcribing','ready','generating');
-
--- A consulta do job de reten\xE7\xE3o.
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_sessions_retention
-  ON public.plg_scribe_sessions(retention_until)
-  WHERE audio_deleted_at IS NULL AND retention_until IS NOT NULL;
-
--- ---------------------------------------------------------------------------
--- 2. segments \u2014 o manifesto dos peda\xE7os
--- ---------------------------------------------------------------------------
--- A PK \xE9 (session_id, seg_index) e n\xE3o um uuid: o \xEDndice do segmento j\xE1 \xE9
--- \xFAnico dentro da sess\xE3o, e usar isso como chave faz o re-upload do mesmo
--- peda\xE7o ser um ON CONFLICT em vez de uma linha duplicada. Idempot\xEAncia de
--- gra\xE7a, que \xE9 exatamente o que um pump com retry infinito precisa.
-CREATE TABLE IF NOT EXISTS public.plg_scribe_segments (
-  session_id      uuid NOT NULL REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE,
-  seg_index       integer NOT NULL,
-  tenant_id       uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-
-  storage_path    text,
-  bytes           integer,
-  start_offset_ms integer NOT NULL,
-  -- Vem da resposta do STT. O rel\xF3gio do JS n\xE3o \xE9 testemunha confi\xE1vel de
-  -- quanto \xE1udio existe: ele conta tempo, n\xE3o amostras.
-  duration_ms     integer,
-
-  -- Montado a partir de pieces de um segmento cortado no meio (crash). Vale
-  -- transcrever mesmo assim: 22 segundos de consulta \xE9 melhor que zero.
-  partial         boolean NOT NULL DEFAULT false,
-
-  -- Linha SINT\xC9TICA: n\xE3o tem \xE1udio, marca um buraco (sono, mic perdido,
-  -- permiss\xE3o revogada). Existe para a transcri\xE7\xE3o ADMITIR o buraco em vez de
-  -- emendar dois momentos como se fossem cont\xEDnuos. Isso \xE9 requisito
-  -- m\xE9dico-legal: um registro que esconde a costura \xE9 pior que um com furo.
-  gap             boolean NOT NULL DEFAULT false,
-
-  upload_state    text NOT NULL DEFAULT 'pending'
-    CHECK (upload_state IN ('pending','uploaded','missing')),
-  uploaded_at     timestamptz,
-
-  stt_state       text NOT NULL DEFAULT 'pending'
-    CHECK (stt_state IN ('pending','running','done','failed','skipped')),
-  stt_provider    text,
-  stt_attempts    smallint NOT NULL DEFAULT 0,
-  stt_error       text,
-
-  text            text,
-  -- [{w,s,e,c,sp}] com offsets RELATIVOS a este segmento. Absoluto se calcula
-  -- somando start_offset_ms; guardar relativo \xE9 o que deixa reprocessar um
-  -- segmento sozinho sem reescrever os vizinhos.
-  words           jsonb,
-  confidence      real,
-
-  created_at      timestamptz NOT NULL DEFAULT now(),
-  updated_at      timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (session_id, seg_index)
+CREATE TABLE public.plg_scribe_segments (
+    session_id uuid NOT NULL,
+    seg_index integer NOT NULL,
+    tenant_id uuid NOT NULL,
+    storage_path text,
+    bytes integer,
+    start_offset_ms integer NOT NULL,
+    duration_ms integer,
+    partial boolean DEFAULT false NOT NULL,
+    gap boolean DEFAULT false NOT NULL,
+    upload_state text DEFAULT 'pending'::text NOT NULL,
+    uploaded_at timestamp with time zone,
+    stt_state text DEFAULT 'pending'::text NOT NULL,
+    stt_provider text,
+    stt_attempts smallint DEFAULT 0 NOT NULL,
+    stt_error text,
+    text text,
+    words jsonb,
+    confidence real,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_segments_stt_state_check CHECK ((stt_state = ANY (ARRAY['pending'::text, 'running'::text, 'done'::text, 'failed'::text, 'skipped'::text]))),
+    CONSTRAINT plg_scribe_segments_upload_state_check CHECK ((upload_state = ANY (ARRAY['pending'::text, 'uploaded'::text, 'missing'::text])))
 );
-ALTER TABLE public.plg_scribe_segments ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_segments_tenant
-  ON public.plg_scribe_segments(tenant_id);
 
--- A fila do STT. Parcial porque s\xF3 interessa o que j\xE1 subiu e ainda n\xE3o foi
--- transcrito \u2014 que \xE9 uma fra\xE7\xE3o min\xFAscula da tabela em regime permanente.
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_segments_stt_queue
-  ON public.plg_scribe_segments(tenant_id, stt_state, created_at)
-  WHERE upload_state = 'uploaded' AND stt_state IN ('pending','failed');
-
--- ---------------------------------------------------------------------------
--- 3. generations \u2014 uma tentativa de documento
--- ---------------------------------------------------------------------------
--- DUAS colunas de markdown, e isso n\xE3o \xE9 redund\xE2ncia.
---
---   \`markdown\`        sa\xEDda do modelo, escrita uma vez, nunca mutada
---   \`markdown_edited\` a c\xF3pia de trabalho do humano
---
--- A diferen\xE7a entre elas \xE9 a \xFAnica prova de que algu\xE9m revisou. Ela sustenta
--- tr\xEAs coisas: o selo "revisado pelo profissional", o diff que diz se o prompt
--- est\xE1 bom (documento muito editado = prompt ruim), e a cadeia de proveni\xEAncia
--- que um registro m\xE9dico-legal precisa ter. Guardar s\xF3 o texto final apaga tudo
--- isso para economizar uma coluna de texto.
-CREATE TABLE IF NOT EXISTS public.plg_scribe_generations (
-  id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id       uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  session_id      uuid NOT NULL REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE,
-
-  -- Um dos dois. \`template_id\` quando o tenant forkou e tem linha pr\xF3pria;
-  -- \`template_key\` quando \xE9 preset de c\xF3digo (que de prop\xF3sito n\xE3o tem linha,
-  -- para n\xE3o consumir a cota de templates do plano).
-  template_id     uuid,
-  template_key    text,
-
-  tab_order       integer NOT NULL DEFAULT 0,
-  title           text,
-  status          text NOT NULL DEFAULT 'pending'
-    CHECK (status IN ('pending','running','ready','failed','committed','discarded')),
-
-  markdown        text,
-  markdown_edited text,
-
-  -- Extra\xE7\xE3o stage-1 do modo two-stage. A coluna entra agora, vazia, porque a
-  -- interface j\xE1 nasce com esse formato \u2014 quando as abas de multi-documento
-  -- chegarem, \xE9 preencher, n\xE3o migrar.
-  facts           jsonb,
-
-  model           text,
-  prompt_version  text,
-  input_tokens    integer,
-  output_tokens   integer,
-  error           text,
-
-  document_id     uuid,
-  created_by      uuid,
-  created_at      timestamptz NOT NULL DEFAULT now(),
-  updated_at      timestamptz NOT NULL DEFAULT now()
+CREATE TABLE public.plg_scribe_sessions (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    subject_id uuid,
+    context_kind text DEFAULT 'person'::text NOT NULL,
+    appointment_id uuid,
+    owner_user_id uuid NOT NULL,
+    status text DEFAULT 'recording'::text NOT NULL,
+    locale text DEFAULT 'pt-BR'::text NOT NULL,
+    mime_type text,
+    started_at timestamp with time zone DEFAULT now() NOT NULL,
+    ended_at timestamp with time zone,
+    wall_duration_ms integer DEFAULT 0 NOT NULL,
+    audio_duration_ms integer DEFAULT 0 NOT NULL,
+    segment_count integer DEFAULT 0 NOT NULL,
+    uploaded_segment_count integer DEFAULT 0 NOT NULL,
+    transcribed_segment_count integer DEFAULT 0 NOT NULL,
+    transcript_chars integer DEFAULT 0 NOT NULL,
+    consent_at timestamp with time zone,
+    consent_mode text,
+    retention_until date,
+    audio_deleted_at timestamp with time zone,
+    error text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_sessions_consent_mode_check CHECK ((consent_mode = ANY (ARRAY['verbal'::text, 'written'::text, 'implied_contract'::text]))),
+    CONSTRAINT plg_scribe_sessions_context_kind_check CHECK ((context_kind = ANY (ARRAY['person'::text, 'appointment'::text, 'standalone'::text]))),
+    CONSTRAINT plg_scribe_sessions_status_check CHECK ((status = ANY (ARRAY['recording'::text, 'paused'::text, 'interrupted'::text, 'uploading'::text, 'transcribing'::text, 'ready'::text, 'generating'::text, 'completed'::text, 'abandoned'::text, 'failed'::text])))
 );
-ALTER TABLE public.plg_scribe_generations ENABLE ROW LEVEL SECURITY;
 
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_generations_session
-  ON public.plg_scribe_generations(session_id, tab_order);
-CREATE INDEX IF NOT EXISTS idx_plg_scribe_generations_tenant
-  ON public.plg_scribe_generations(tenant_id);
 
--- FKs para plugin-forms e para o arqu\xE9tipo de documentos s\xE3o condicionais: o
--- scribe declara \`dependencies: ['custom_forms']\`, mas a ordem de aplica\xE7\xE3o
--- entre plugins n\xE3o \xE9 garantida e um pool pode aplicar este arquivo antes.
--- Guardado, o re-apply converge; sem guarda, quebraria o passo inteiro.
-DO $$
-BEGIN
-  IF to_regclass('public.plg_forms_templates') IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_scribe_generations_template_fk') THEN
-    ALTER TABLE public.plg_scribe_generations
-      ADD CONSTRAINT plg_scribe_generations_template_fk
-      FOREIGN KEY (template_id) REFERENCES public.plg_forms_templates(id) ON DELETE SET NULL;
-  END IF;
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
-  IF to_regclass('public.documents') IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_scribe_generations_document_fk') THEN
-    ALTER TABLE public.plg_scribe_generations
-      ADD CONSTRAINT plg_scribe_generations_document_fk
-      FOREIGN KEY (document_id) REFERENCES public.documents(id) ON DELETE SET NULL;
-  END IF;
-END $$;
-
--- ---------------------------------------------------------------------------
--- 4. RLS \u2014 a forma can\xF4nica deste repo, tr\xEAs tabelas x quatro verbos
--- ---------------------------------------------------------------------------
-DROP POLICY IF EXISTS plg_scribe_sessions_select ON public.plg_scribe_sessions;
-CREATE POLICY plg_scribe_sessions_select ON public.plg_scribe_sessions FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_sessions_insert ON public.plg_scribe_sessions;
-CREATE POLICY plg_scribe_sessions_insert ON public.plg_scribe_sessions FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_sessions_update ON public.plg_scribe_sessions;
-CREATE POLICY plg_scribe_sessions_update ON public.plg_scribe_sessions FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_sessions_delete ON public.plg_scribe_sessions;
-CREATE POLICY plg_scribe_sessions_delete ON public.plg_scribe_sessions FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_scribe_sessions TO authenticated;
-
-DROP POLICY IF EXISTS plg_scribe_segments_select ON public.plg_scribe_segments;
-CREATE POLICY plg_scribe_segments_select ON public.plg_scribe_segments FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_segments_insert ON public.plg_scribe_segments;
-CREATE POLICY plg_scribe_segments_insert ON public.plg_scribe_segments FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_segments_update ON public.plg_scribe_segments;
-CREATE POLICY plg_scribe_segments_update ON public.plg_scribe_segments FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_segments_delete ON public.plg_scribe_segments;
-CREATE POLICY plg_scribe_segments_delete ON public.plg_scribe_segments FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_scribe_segments TO authenticated;
-
-DROP POLICY IF EXISTS plg_scribe_generations_select ON public.plg_scribe_generations;
-CREATE POLICY plg_scribe_generations_select ON public.plg_scribe_generations FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_generations_insert ON public.plg_scribe_generations;
-CREATE POLICY plg_scribe_generations_insert ON public.plg_scribe_generations FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_generations_update ON public.plg_scribe_generations;
-CREATE POLICY plg_scribe_generations_update ON public.plg_scribe_generations FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-DROP POLICY IF EXISTS plg_scribe_generations_delete ON public.plg_scribe_generations;
-CREATE POLICY plg_scribe_generations_delete ON public.plg_scribe_generations FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_scribe_generations TO authenticated;
-
--- ---------------------------------------------------------------------------
--- 5. scribe_record_segment \u2014 o browser registra, o banco conta
--- ---------------------------------------------------------------------------
--- SECURITY INVOKER: a RLS acima j\xE1 amarra o tenant. N\xE3o h\xE1 nada aqui que
--- precise de privil\xE9gio elevado, e uma fun\xE7\xE3o SECURITY DEFINER que n\xE3o precisa
--- ser \xE9 s\xF3 superf\xEDcie de ataque a mais.
---
--- O ponto da fun\xE7\xE3o \xE9 a segunda metade: recalcular os contadores da sess\xE3o a
--- partir de um SELECT sobre os segmentos, nunca de um \`+1\` vindo do cliente.
--- Um pump com retry infinito vai reenviar o mesmo segmento, e um contador
--- incremental transformaria isso em n\xFAmeros que crescem sem o \xE1udio crescer.
-CREATE OR REPLACE FUNCTION public.scribe_record_segment(p_payload jsonb)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY INVOKER
-SET search_path TO 'public'
-AS $function$
+CREATE FUNCTION public.scribe_audio_path_ok(p_name text) RETURNS boolean
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $_$
+  SELECT
+    p_name IS NOT NULL
+    AND length(p_name) <= 200
+    AND p_name ~ ('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+               || '/[0-9]{4}/[0-9]{2}'
+               || '/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+               || '/[0-9]{5}\\.(webm|ogg|m4a|mp3)$')
+    -- compara\xE7\xE3o em texto (nunca \`::uuid\`): entrada malformada devolve falso em
+    -- vez de derrubar a policy com erro de cast.
+    AND EXISTS (
+      SELECT 1 FROM public.tenants t WHERE t.id::text = split_part(p_name, '/', 1)
+    );
+$_$;
+
+CREATE FUNCTION public.scribe_record_segment(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql
+    SET search_path TO 'public'
+    AS $$
 DECLARE
   v_session_id uuid;
   v_seg_index  integer;
@@ -3021,115 +2904,324 @@ BEGIN
 
   RETURN v_result;
 END;
-$function$;
+$$;
 
-COMMENT ON FUNCTION public.scribe_record_segment(jsonb) IS
-  'Idempotent upsert of one audio segment + recomputation of the parent session counters from the segments table. Called by the browser upload pump after each successful Storage write.';
 
-GRANT EXECUTE ON FUNCTION public.scribe_record_segment(jsonb) TO authenticated;
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
--- ---------------------------------------------------------------------------
--- 6. o bucket
--- ---------------------------------------------------------------------------
--- PRIVADO, sem discuss\xE3o: \xE9 a voz de uma pessoa falando da pr\xF3pria sa\xFAde. URL
--- p\xFAblica seria um endere\xE7o eterno para isso. O backoffice l\xEA por URL assinada
--- de curta dura\xE7\xE3o; a edge function de transcri\xE7\xE3o l\xEA com service key.
---
--- 5 MB por SEGMENTO \xE9 folgado por design: 30 s de Opus mono a 24 kbps d\xE1 ~90 KB.
--- O limite existe para barrar um cliente com bug mandando um arquivo inteiro,
--- n\xE3o para apertar o caso normal.
-INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
-VALUES (
-  'scribe-audio',
-  'scribe-audio',
-  false,
-  5242880,
-  ARRAY['audio/webm','audio/ogg','audio/mp4','audio/mpeg','audio/m4a','audio/x-m4a']
-)
-ON CONFLICT (id) DO UPDATE SET
-  public             = EXCLUDED.public,
-  file_size_limit    = EXCLUDED.file_size_limit,
-  allowed_mime_types = EXCLUDED.allowed_mime_types;
-
--- ---------------------------------------------------------------------------
--- 7. o caminho \xE9 v\xE1lido?
--- ---------------------------------------------------------------------------
--- Gram\xE1tica (o SDK constr\xF3i, o banco confere):
---
---   {tenant_id}/{yyyy}/{mm}/{session_id}/{seg_index:05d}.{ext}
---        1         2     3        4              5
---
---   1 tenant_id   chave do isolamento \u2014 toda policy pendura aqui
---   2,3 yyyy/mm   varredura de reten\xE7\xE3o por prefixo (LGPD), pasta list\xE1vel
---   4 session_id  uuid do cliente: agrupa a sess\xE3o e \xE9 imprevis\xEDvel
---   5 seg_index   zero-padded, ent\xE3o list() j\xE1 volta em ordem cronol\xF3gica
---
--- SECURITY DEFINER porque o EXISTS olha \`tenants\`, que tem RLS.
-CREATE OR REPLACE FUNCTION public.scribe_audio_path_ok(p_name text)
-RETURNS boolean
-LANGUAGE sql
-STABLE
-SECURITY DEFINER
-SET search_path TO 'public'
-AS $function$
-  SELECT
-    p_name IS NOT NULL
-    AND length(p_name) <= 200
-    AND p_name ~ ('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
-               || '/[0-9]{4}/[0-9]{2}'
-               || '/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
-               || '/[0-9]{5}\\.(webm|ogg|m4a|mp3)$')
-    -- compara\xE7\xE3o em texto (nunca \`::uuid\`): entrada malformada devolve falso em
-    -- vez de derrubar a policy com erro de cast.
-    AND EXISTS (
-      SELECT 1 FROM public.tenants t WHERE t.id::text = split_part(p_name, '/', 1)
-    );
-$function$;
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_pkey PRIMARY KEY (id);
 
-COMMENT ON FUNCTION public.scribe_audio_path_ok(text) IS
-  'True when a storage object name follows the scribe-audio grammar {tenant}/{yyyy}/{mm}/{session}/{segIndex}.{ext} and segment 1 is a real tenant. Used by the INSERT policy on that bucket.';
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_pkey PRIMARY KEY (session_id, seg_index);
 
-GRANT EXECUTE ON FUNCTION public.scribe_audio_path_ok(text) TO authenticated;
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_pkey PRIMARY KEY (id);
 
--- ---------------------------------------------------------------------------
--- 8. pol\xEDticas do bucket
--- ---------------------------------------------------------------------------
-DROP POLICY IF EXISTS plg_scribe_audio_insert ON storage.objects;
-DROP POLICY IF EXISTS plg_scribe_audio_read ON storage.objects;
-DROP POLICY IF EXISTS plg_scribe_audio_delete ON storage.objects;
 
--- Escrever: s\xF3 logado (diferente do bucket do CRM, que aceita visitante an\xF4nimo
--- \u2014 aqui quem grava \xE9 sempre um profissional autenticado), dentro da gram\xE1tica
--- e da pr\xF3pria pasta.
---
--- N\xC3O existe policy de UPDATE, e isso \xE9 a trava mais importante das tr\xEAs: sem
--- ela o \`upsert\` falha, e um caminho j\xE1 gravado NUNCA pode ser trocado por
--- outro conte\xFAdo. \xC9 o que torna o \xE1udio uma testemunha e n\xE3o um rascunho.
-CREATE POLICY plg_scribe_audio_insert ON storage.objects
-  FOR INSERT TO authenticated
-  WITH CHECK (
-    bucket_id = 'scribe-audio'
-    AND public.scribe_audio_path_ok(name)
-    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
-  );
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
-CREATE POLICY plg_scribe_audio_read ON storage.objects
-  FOR SELECT TO authenticated
-  USING (
-    bucket_id = 'scribe-audio'
-    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
-  );
+CREATE VIEW public.v_scribe_generations WITH (security_invoker='true') AS
+ SELECT g.id,
+    g.tenant_id,
+    g.session_id,
+    g.template_id,
+    g.template_key,
+    g.tab_order,
+    g.title,
+    g.status,
+    g.markdown,
+    g.markdown_edited,
+    g.facts,
+    g.model,
+    g.prompt_version,
+    g.input_tokens,
+    g.output_tokens,
+    g.error,
+    g.document_id,
+    g.created_by,
+    g.created_at,
+    g.updated_at,
+    (t.id IS NOT NULL) AS template_exists,
+    t.name AS template_name
+   FROM (public.plg_scribe_generations g
+     LEFT JOIN public.plg_forms_templates t ON ((t.id = g.template_id)));
 
--- Apagar: mesma regra da leitura. \xC9 o que torna "apagar o \xE1udio desta sess\xE3o"
--- execut\xE1vel por quem \xE9 dono dele \u2014 o direito de elimina\xE7\xE3o do art. 18 VI n\xE3o
--- vale nada se ningu\xE9m no tenant consegue exerc\xEA-lo.
-CREATE POLICY plg_scribe_audio_delete ON storage.objects
-  FOR DELETE TO authenticated
-  USING (
-    bucket_id = 'scribe-audio'
-    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
-  );
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE INDEX idx_plg_scribe_generations_session ON public.plg_scribe_generations USING btree (session_id, tab_order);
+
+CREATE INDEX idx_plg_scribe_generations_tenant ON public.plg_scribe_generations USING btree (tenant_id);
+
+CREATE INDEX idx_plg_scribe_segments_stt_queue ON public.plg_scribe_segments USING btree (tenant_id, stt_state, created_at) WHERE ((upload_state = 'uploaded'::text) AND (stt_state = ANY (ARRAY['pending'::text, 'failed'::text])));
+
+CREATE INDEX idx_plg_scribe_segments_tenant ON public.plg_scribe_segments USING btree (tenant_id);
+
+CREATE INDEX idx_plg_scribe_sessions_appointment ON public.plg_scribe_sessions USING btree (appointment_id) WHERE (appointment_id IS NOT NULL);
+
+CREATE INDEX idx_plg_scribe_sessions_open ON public.plg_scribe_sessions USING btree (tenant_id, owner_user_id, status) WHERE (status = ANY (ARRAY['recording'::text, 'paused'::text, 'interrupted'::text, 'uploading'::text, 'transcribing'::text, 'ready'::text, 'generating'::text]));
+
+CREATE INDEX idx_plg_scribe_sessions_retention ON public.plg_scribe_sessions USING btree (retention_until) WHERE ((audio_deleted_at IS NULL) AND (retention_until IS NOT NULL));
+
+CREATE INDEX idx_plg_scribe_sessions_subject ON public.plg_scribe_sessions USING btree (subject_id) WHERE (subject_id IS NOT NULL);
+
+CREATE INDEX idx_plg_scribe_sessions_tenant ON public.plg_scribe_sessions USING btree (tenant_id);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_document_fk FOREIGN KEY (document_id) REFERENCES public.documents(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_session_id_fkey FOREIGN KEY (session_id) REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_session_id_fkey FOREIGN KEY (session_id) REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_appointment_id_fkey FOREIGN KEY (appointment_id) REFERENCES public.appointments(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_subject_id_fkey FOREIGN KEY (subject_id) REFERENCES public.people(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_scribe_generations ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_scribe_segments ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_scribe_sessions ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_scribe_generations_delete ON public.plg_scribe_generations FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_insert ON public.plg_scribe_generations FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_select ON public.plg_scribe_generations FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_update ON public.plg_scribe_generations FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_delete ON public.plg_scribe_segments FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_insert ON public.plg_scribe_segments FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_select ON public.plg_scribe_segments FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_update ON public.plg_scribe_segments FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_delete ON public.plg_scribe_sessions FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_insert ON public.plg_scribe_sessions FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_select ON public.plg_scribe_sessions FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_update ON public.plg_scribe_sessions FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+GRANT ALL ON FUNCTION public.scribe_audio_path_ok(p_name text) TO authenticated;
+GRANT ALL ON FUNCTION public.scribe_audio_path_ok(p_name text) TO service_role;
+
+GRANT ALL ON FUNCTION public.scribe_record_segment(p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.scribe_record_segment(p_payload jsonb) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_generations TO anon;
+GRANT ALL ON TABLE public.plg_scribe_generations TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_generations TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_segments TO anon;
+GRANT ALL ON TABLE public.plg_scribe_segments TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_segments TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_sessions TO anon;
+GRANT ALL ON TABLE public.plg_scribe_sessions TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_sessions TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_scribe_generations TO anon;
+GRANT ALL ON TABLE public.v_scribe_generations TO authenticated;
+GRANT ALL ON TABLE public.v_scribe_generations TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.scribe_audio_path_ok(p_name text) IS 'True when a storage object name follows the scribe-audio grammar {tenant}/{yyyy}/{mm}/{session}/{segIndex}.{ext} and segment 1 is a real tenant. Used by the INSERT policy on that bucket.';
+
+COMMENT ON FUNCTION public.scribe_record_segment(p_payload jsonb) IS 'Idempotent upsert of one audio segment + recomputation of the parent session counters from the segments table. Called by the browser upload pump after each successful Storage write.';
+
+COMMENT ON COLUMN public.plg_scribe_generations.template_id IS 'The forms template this generation came from, by id and not by foreign key (003, ADR 0015). A soft reference on purpose: forms owns that table and must be able to release it without scribe''s permission. A row whose template is gone reads as absent, which is what the old ON DELETE SET NULL was arranging.';
+
+COMMENT ON VIEW public.v_scribe_generations IS 'Generations with their forms template resolved by LEFT JOIN rather than by foreign key (003). \`template_exists\` is the honest answer on a cluster where forms is not installed, or where the template was deleted.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
 `;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE }
+];
 var STATUS_LABELS = {
   recording: "Gravando",
   paused: "Pausado",
@@ -3576,14 +3668,15 @@ function createScribePlugin(options) {
         ]
       }
     ],
-    migrations: [
-      {
-        id: "scribe-001-base",
-        version: "0.1.0",
-        sql: MIGRATION_001_SCRIBE_BASE,
-        description: "Cria plg_scribe_sessions/_segments/_generations, o bucket privado scribe-audio com guard de caminho, e o RPC scribe_record_segment"
-      }
-    ],
+    // One baseline per unit since #338 — read from the generated barrel
+    // rather than listed here, so regenerating the SQL never needs a
+    // manifest edit to match.
+    migrations: MIGRATIONS.map((entry) => ({
+      id: `scribe-${entry.id}`,
+      version: "1.0.0",
+      sql: entry.sql,
+      description: "The whole schema this plugin provisions, as one file: every table, view, function, policy and grant, plus the reference rows it seeds. Replaced the per-change chain in the 1.0.0 squash (#338); the files it collapsed are kept, unapplied, in src/migrations.archive/."
+    })),
     locales: scribeLocales
   };
 }