@fayz-ai/plugin-workforce 0.3.14 → 0.3.15

package/dist/migrations/main.js

@@ -0,0 +1,3141 @@
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- O RH ganha ponto e escala.
+--
+-- D9 \xB7 Gente & Jornada de trabalho \xE9 o \xFAltimo dom\xEDnio inteiro do V1 sem NENHUMA
+-- contraparte no V2. O registro de features do app diz isso feature por feature:
+-- \`sch.templates\` P0 missing, \`sch.calendar\` P0 missing ("Nenhum m\xF3dulo do SDK \xE9
+-- dono disso hoje \u2014 precisa de uma decis\xE3o antes de c\xF3digo"), \`sch.clock\` P1
+-- missing ("O que existe \xE9 o hor\xE1rio PREVISTO de trabalho. A batida realizada,
+-- com ajuste auditado, n\xE3o existe"), \`sch.clock.adjust\` P1 missing. O host
+-- previsto para os quatro \xE9 o mesmo: **plugin-workforce**. Este arquivo \xE9 a
+-- camada de dados dele.
+--
+-- \u2500\u2500 O que foi medido na origem (Pertinho do C\xE9u, licen\xE7a 8, 07/09/2026) \u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Da documenta\xE7\xE3o do V1 (\`docs/v1-guide/restaurante/escalas/FLOW.md\` e
+-- \`docs/v1-guide/agenda/ponto-eletronico/FLOW.md\`), tudo verificado na tela:
+--
+--     325   registros de ponto no per\xEDodo \u2014 e TODOS os 325 marcados
+--           "Fora da escala" (V1-043). A coluna existe justamente para cruzar
+--           ponto \xD7 escala e nunca varia: o ponto est\xE1 ativo em \`PC Servi\xE7os\`
+--           enquanto a opera\xE7\xE3o e as escalas s\xE3o de \`Pertinho do C\xE9u\`.
+--      20   batimentos EM ABERTO, incluindo 5 de 5 hoje e 8 de 16 ontem; um
+--           deles com entrada \xE0s 23:29 e "13h07 (parcial)".
+-- R$ 47.747 o valor do per\xEDodo \u2014 SUBESTIMADO, porque o V1 s\xF3 calcula valor no
+--           fechamento do par, e 20 pares nunca fecharam.
+--     103   profissionais habilitados para arrastar numa vaga de template.
+--       7   templates de escala no tenant.
+--
+-- Tr\xEAs dos n\xFAmeros acima s\xE3o sintoma do MESMO defeito de modelo, e \xE9 ele que
+-- este arquivo existe para n\xE3o repetir: no V1 a batida \xE9 um par entrada/sa\xEDda
+-- numa \xFAnica linha, com o ajuste como colunas \`*_adjusted_at\` por cima. Um par
+-- que nunca fecha n\xE3o tem dura\xE7\xE3o, n\xE3o tem valor e n\xE3o tem como ser conferido
+-- contra nada.
+--
+-- \u2500\u2500 Duas decis\xF5es de arquitetura que o reposit\xF3rio j\xE1 tomou \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 1. *"Ponto \xE9 raz\xE3o append-only, como todo saldo \u2014 nunca uma coluna que algu\xE9m
+--    edita."* (\`docs/migration/how-to-port.json\`, mv.sch.clock: *"Batida \xE9
+--    append-only e ajuste \xE9 registro separado com autor e motivo \u2014 apagar
+--    batida \xE9 o que a lei n\xE3o permite."*)
+--
+--    Por isso \`plg_workforce_time_entries\` \xE9 append-only de verdade \u2014 trigger
+--    que recusa UPDATE e DELETE, e as policies de UPDATE/DELETE derrubadas
+--    depois do scaffold \u2014 e o ajuste do V1 (\`checkin_adjusted_at\`,
+--    \`checkout_adjusted_at\`, \`adjustment_reason\`, \`adjusted_by_*\`) vira LINHA em
+--    \`plg_workforce_time_adjustments\`, com autor, motivo e carimbo. A pr\xF3pria
+--    tela do V1 j\xE1 enuncia a regra que o V2 passa a garantir no banco: *"Os
+--    hor\xE1rios reais dos batimentos s\xE3o preservados."*
+--
+-- 2. *"Escala de funcion\xE1rio N\xC3O mora na agenda \u2014 quem oferta hor\xE1rio \xE9 o RH, a
+--    agenda s\xF3 consome."* (registro de features, dom\xEDnio D3.)
+--
+--    Por isso a escala \xE9 deste plugin, e a ponte com a agenda \xE9 UMA coluna:
+--    \`plg_workforce_schedule_assignments.schedule_row_id\`, que aponta para a
+--    linha de \`public.schedules\` que a publica\xE7\xE3o materializa.
+--
+-- \u2500\u2500 O que este arquivo N\xC3O cria, porque j\xE1 existe \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O PREVISTO j\xE1 est\xE1 no V2. \`public.schedules\` (spine) tem exatamente a forma
+-- de uma oferta de hor\xE1rio \u2014 \`kind\`, \`assignee_id\` \u2192 \`public.people\`,
+-- \`day_of_week\`, \`specific_date\`, \`starts_at\`, \`ends_at\`, \`unit_id\` \u2014 e
+-- \`public.schedule_kinds\` \xE9 o registro de esp\xE9cies dela (hoje: working_hours,
+-- exception, block, unclassified). Criar uma tabela de escala prevista aqui
+-- seria a segunda tabela de hor\xE1rio do cluster, que diverge da primeira na
+-- pr\xF3xima mudan\xE7a. Em vez disso este arquivo **semeia a esp\xE9cie \`work_shift\`** e
+-- usa \`public.schedules\`.
+--
+-- \`public.people\` tamb\xE9m j\xE1 resolve sozinha o pior defeito do modelo do V1: l\xE1 o
+-- ponto aponta para \`person_type ENUM('professional','employee')\` + \`person_id\`,
+-- uma FK polim\xF3rfica para duas tabelas de cadastro que a pr\xF3pria tela mistura
+-- ("A aba mistura Profissional e Funcion\xE1rio no mesmo filtro e na mesma lista, e
+-- a diferen\xE7a entre os dois cadastros n\xE3o \xE9 explicada em lugar nenhum"). No V2
+-- os dois j\xE1 s\xE3o \`public.people\` com papel em \`public.person_roles\`, ent\xE3o o par
+-- vira UMA FK \`person_id uuid \u2192 public.people(id)\`.
+--
+-- N\xC3O porta \`schedule_grids\` / \`schedule_grid_blocks\`: apesar do nome s\xE3o grade
+-- de disponibilidade de AGENDAMENTO, n\xE3o escala de trabalho. Ficam registradas
+-- em \`migration.excluded_tables\` com o motivo, que \xE9 mais barato que descobrir
+-- isso de novo daqui a seis meses.
+--
+-- \u2500\u2500 As tr\xEAs lacunas do V1 que o V2 resolve aqui \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- (a) FECHAMENTO DE COMPET\xCANCIA. O V1 n\xE3o tem nenhum. Qualquer ajuste pode
+--     mudar, em sil\xEAncio, um m\xEAs de horas j\xE1 entregue ao contador e j\xE1 pago \u2014
+--     e a \xFAnica trava que existe \xE9 de tela: \`payable_invoice_id\` preenchido
+--     esconde o bot\xE3o "Ajustar". Uma trava de tela \xE9 uma trava at\xE9 a primeira
+--     chamada de API.
+--     \u2192 \`plg_workforce_periods\`, no MESMO padr\xE3o que o financeiro j\xE1 provou em
+--       \`plugin-financial/src/migrations/006\`: compet\xEAncia \xE9 o M\xCAS (data no dia
+--       1\xBA, por constraint), \xE9 do TENANT e n\xE3o da unidade (um m\xEAs meio fechado \xE9
+--       a pior resposta poss\xEDvel para quem precisa dizer que acabou), a escrita
+--       \xE9 s\xF3 por RPC (\`workforce_period_close\` / \`workforce_period_reopen\`, sem
+--       policy de INSERT/UPDATE \u2014 uma policy de UPDATE seria a porta dos fundos
+--       da trava), reabrir exige motivo, e a permiss\xE3o de fechar \xE9 pr\xF3pria
+--       (\`workforce.close_period\`): quem bate ponto n\xE3o \xE9 quem fecha o m\xEAs.
+--       A trava vira trigger sobre a batida E sobre o ajuste, e o ajuste ganha
+--       a segunda trava do V1, agora no banco: batida j\xE1 vinculada a um t\xEDtulo
+--       a pagar n\xE3o aceita ajuste.
+--
+-- (b) JORNADA PREVISTA \xD7 REALIZADA. No V1 elas nunca se encontram: a coluna
+--     "Escala" da lista de ponto existe para isso e marcou 325 de 325 registros
+--     como "Fora da escala".
+--     \u2192 O PREVISTO mora em \`public.schedules\` com \`kind = 'work_shift'\` (n\xE3o em
+--       tabela nova \u2014 ver acima); o REALIZADO mora em
+--       \`plg_workforce_time_entries\`; e o cruzamento \xE9 a view
+--       \`public.v_workforce_day\`, um FULL OUTER JOIN de prop\xF3sito, para que as
+--       duas assimetrias apare\xE7am em vez de sumirem: previsto sem realizado \xE9
+--       FALTA, realizado sem previsto \xE9 FORA DA ESCALA. A publica\xE7\xE3o da escala
+--       materializa a linha de \`public.schedules\` e guarda o id em
+--       \`plg_workforce_schedule_assignments.schedule_row_id\`, que \xE9 o que torna
+--       o cruzamento uma chave e n\xE3o uma heur\xEDstica de nome e hor\xE1rio.
+--
+-- (c) INTERVALO / ALMO\xC7O. O V1 tem UM par entrada/sa\xEDda por ciclo. Quem sai para
+--     almo\xE7ar e volta ou n\xE3o registra o intervalo, ou bate a sa\xEDda e a entrada e
+--     o dia vira dois registros que ningu\xE9m soma. Num restaurante com turno
+--     partido isso \xE9 a jornada inteira.
+--     \u2192 A batida deixa de ser um PAR numa linha e passa a ser um EVENTO:
+--       \`kind \u2208 (clock_in, break_start, break_end, clock_out)\`, N por dia,
+--       agrupados por \`(person_id, work_date)\` e ordenados por \`seq\`. A mesma
+--       decis\xE3o que satisfaz o append-only resolve o intervalo de gra\xE7a, e ainda
+--       responde "quais pontos est\xE3o em aberto?" sem coluna derivada: em aberto
+--       \xE9 o dia cujos eventos de abertura (clock_in, break_end) n\xE3o empatam com
+--       os de fechamento (clock_out, break_start).
+--       \`work_date\` \xE9 coluna, e n\xE3o \`punched_at::date\`, porque o V1 j\xE1 convive
+--       com o turno que cruza a meia-noite \u2014 a pr\xF3pria caixa de ajuste avisa:
+--       *"\xFAtil quando o funcion\xE1rio esqueceu de bater a sa\xEDda e o registro
+--       cruzou para o dia seguinte"*. A jornada da noite de s\xE1bado \xE9 de s\xE1bado.
+--
+-- \u2500\u2500 Uma decis\xE3o a mais, tomada na fronteira da migra\xE7\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- No molde do V1, titular vs stand-by \xE9 POSICIONAL: s\xE3o titulares os primeiros
+-- \`required_count\` de \`schedule_template_assignments\` por \`priority\`, e o resto
+-- \xE9 reserva. Ningu\xE9m grava isso; \xE9 uma regra que vive no c\xF3digo da tela. Na
+-- inst\xE2ncia o V1 j\xE1 tem \`role\` como coluna de verdade. Aqui o molde tamb\xE9m tem:
+-- \`plg_workforce_schedule_template_assignments.role\` \xE9 coluna, e o writer da
+-- migra\xE7\xE3o CALCULA a posi\xE7\xE3o uma vez, contra o \`required_count\` da fun\xE7\xE3o,
+-- em vez de deixar a regra escondida em cada leitor que vier depois.
+--
+-- Idempotente. Nada aqui apaga dado.
+
+-- A RPC de fechamento consulta a view de cruzamento, que nasce tr\xEAs se\xE7\xF5es
+-- depois dela \u2014 as duas moram onde o assunto est\xE1, n\xE3o onde o carregador
+-- preferiria. Sess\xE3o, e \xE9 o que os baselines gerados do cluster j\xE1 fazem.
+SET check_function_bodies = false;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 0. O plugin existe: as permiss\xF5es
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- O scaffold desenha as policies em cima de \`<plugin>.read/create/edit/delete\`
+-- e \`<plugin>.read_all\`. Sem essas chaves no cat\xE1logo, a policy compila e nega
+-- tudo para todo mundo \u2014 uma tabela protegida por n\xE3o existir para ningu\xE9m.
+--
+-- Duas chaves s\xE3o separadas de prop\xF3sito, e as duas s\xE3o segrega\xE7\xE3o de fun\xE7\xE3o:
+-- \`workforce.adjust_time\` porque corrigir a batida de outra pessoa \xE9 outra
+-- ordem de decis\xE3o que editar uma escala, e \`workforce.close_period\` porque
+-- quem aponta n\xE3o \xE9 quem fecha o m\xEAs.
+SELECT app.seed_permissions('[
+  {"key": "workforce.read",         "plugin": "workforce", "description": "Ver escala, ponto e compet\xEAncia."},
+  {"key": "workforce.create",       "plugin": "workforce", "description": "Criar escala, template e batida."},
+  {"key": "workforce.edit",         "plugin": "workforce", "description": "Editar escala e template."},
+  {"key": "workforce.delete",       "plugin": "workforce", "description": "Excluir escala e template."},
+  {"key": "workforce.manage",       "plugin": "workforce", "description": "Administrar o m\xF3dulo de jornada."},
+  {"key": "workforce.read_all",     "plugin": "workforce", "description": "Ver a jornada de todo mundo, e n\xE3o s\xF3 a pr\xF3pria."},
+  {"key": "workforce.adjust_time",  "plugin": "workforce", "description": "Ajustar batida de ponto. Separada de workforce.edit: corrigir a hora de outra pessoa \xE9 prova, n\xE3o edi\xE7\xE3o."},
+  {"key": "workforce.close_period", "plugin": "workforce", "description": "Fechar e reabrir a compet\xEAncia de jornada. Separada de workforce.edit: quem aponta n\xE3o \xE9 quem fecha."}
+]'::jsonb);
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 1. O PREVISTO j\xE1 existe \u2014 s\xF3 falta a esp\xE9cie
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- \`working_hours\` \xE9 a semana recorrente do PROFISSIONAL, para a agenda saber que
+-- um hor\xE1rio pode existir. \`work_shift\` \xE9 outra coisa: \xE9 o turno de trabalho que
+-- o RH ofertou para uma pessoa num dia, e \xE9 contra ele que o ponto \xE9 conferido.
+-- Reaproveitar \`working_hours\` misturaria "posso ser agendado" com "estou
+-- escalado", que \xE9 justamente a confus\xE3o que o D3 mandou n\xE3o fazer.
+INSERT INTO public.schedule_kinds (kind, plugin, description, status)
+VALUES ('work_shift', 'workforce',
+        'O turno de trabalho que o RH escalou para uma pessoa \u2014 o PREVISTO contra o qual o ponto \xE9 conferido. Distinto de working_hours, que diz apenas quando um hor\xE1rio PODE existir na agenda.',
+        'declared')
+ON CONFLICT (kind) DO UPDATE
+  SET plugin = EXCLUDED.plugin, description = EXCLUDED.description, updated_at = now();
+
+-- \`public.schedules\` foi scaffoldada em modo \`shadow\` (065): as policies de
+-- autoriza\xE7\xE3o existem, mas as anteriores nunca foram derrubadas, e RLS soma
+-- policies em OR \u2014 uma policy legada sobrevivente alarga tudo silenciosamente.
+-- A partir do momento em que a escala do RH mora aqui dentro, sombra n\xE3o serve:
+-- \`scaffold_set_mode\` reemite com os MESMOS resource_type/plugin j\xE1 registrados
+-- (\`agenda.schedule\` / \`agenda\`) e derruba o que sobrou. N\xE3o \xE9 \`scaffold_table\`:
+-- repetir o scaffold aqui reclassificaria uma tabela do spine para dentro deste
+-- plugin, e a agenda perderia a pr\xF3pria mesa.
+DO $$
+BEGIN
+  IF to_regclass('public.schedules') IS NOT NULL
+     AND EXISTS (SELECT 1 FROM app.scaffold_registry
+                  WHERE table_schema = 'public' AND table_name = 'schedules' AND mode = 'shadow') THEN
+    PERFORM app.scaffold_set_mode('public.schedules'::regclass, 'enforce');
+  END IF;
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 2. O REALIZADO: a batida, append-only
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_time_entries (
+  id                uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id         uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id           uuid REFERENCES app.units(id),
+  -- UMA fk, onde o V1 tem person_type + person_id. \`public.people\` j\xE1 \xE9 o
+  -- cadastro \xFAnico; profissional e funcion\xE1rio s\xE3o pap\xE9is em person_roles.
+  person_id         uuid NOT NULL REFERENCES public.people(id) ON DELETE RESTRICT,
+  -- O nome COMO ESTAVA na hora da batida. N\xE3o \xE9 desnormaliza\xE7\xE3o por pregui\xE7a: a
+  -- folha de ponto \xE9 prova, e prova n\xE3o pode mudar porque algu\xE9m corrigiu um
+  -- cadastro dois anos depois.
+  person_name       text,
+  -- O evento, n\xE3o o par. \xC9 esta coluna que resolve o intervalo (c): o almo\xE7o \xE9
+  -- break_start + break_end, e o dia aceita quantos pares de intervalo houver.
+  kind              text NOT NULL
+                    CHECK (kind IN ('clock_in', 'break_start', 'break_end', 'clock_out')),
+  punched_at        timestamptz NOT NULL,
+  -- O DIA DA JORNADA, que n\xE3o \xE9 \`punched_at::date\`. O turno da noite de s\xE1bado
+  -- que sai \xE0s 02:10 \xE9 jornada de s\xE1bado; o V1 j\xE1 convive com isso e a pr\xF3pria
+  -- caixa de ajuste dele avisa que o registro "cruzou para o dia seguinte".
+  work_date         date NOT NULL,
+  -- Ordena os eventos do dia quando dois caem no mesmo instante (totem com
+  -- clique duplo, importa\xE7\xE3o em lote). Sem ele o "\xFAltimo evento do dia" \xE9
+  -- indeterminado, e \xE9 ele que diz se o ponto est\xE1 em aberto.
+  seq               integer NOT NULL DEFAULT 1,
+  origin            text NOT NULL DEFAULT 'totem'
+                    CHECK (origin IN ('totem', 'device', 'manual', 'import', 'migration')),
+  -- A prova que o totem produz: foto, coordenada com precis\xE3o, semelhan\xE7a
+  -- facial, IP e aparelho. Fica em jsonb e n\xE3o em dez colunas porque \xE9 um
+  -- conjunto de evid\xEAncia de UM canal de captura \u2014 o totem com AWS Rekognition
+  -- do V1 \u2014 e o pr\xF3ximo canal (crach\xE1, biometria local) traz outro conjunto.
+  -- O que n\xE3o pode \xE9 perder: no V1 s\xE3o \`photo_path\`, \`lat\`, \`lng\`, \`accuracy_m\`,
+  -- \`ip\`, \`user_agent\` e \`face_score\`, medidos em campo como
+  -- "-22.89342, -43.39140 \xB7 \xB1 14m" e "Match facial 100.0%".
+  evidence          jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- O turno que esta batida cumpre, quando h\xE1 um. Nulo \xE9 uma resposta leg\xEDtima
+  -- e frequente \u2014 \xE9 literalmente 325 de 325 no tenant medido \u2014 e o V2 prefere
+  -- o nulo honesto a um v\xEDnculo inventado.
+  assignment_id     uuid,
+  -- Onde esta hora custa. O turno traz o padr\xE3o (ver plg_workforce_schedule_shifts);
+  -- a batida carrega o que de fato foi classificado, porque a hora do cozinheiro
+  -- e a do gar\xE7om caem em centros de custo diferentes no mesmo dia.
+  -- Sem FK inline: as tr\xEAs colunas abaixo apontam para tabelas de OUTRO plugin,
+  -- e a jornada tem de poder ser instalada num cluster que n\xE3o ligou o
+  -- financeiro. A FK \xE9 declarada no fim do arquivo, condicionada \xE0 exist\xEAncia do
+  -- destino \u2014 presente vira integridade, ausente vira s\xF3 um uuid guardado.
+  chart_account_id  uuid,
+  cost_center_id    uuid,
+  -- O \`payable_invoice_id\` do V1. No V1 ele \xE9 uma trava DE TELA (preenchido,
+  -- o bot\xE3o "Ajustar" some); aqui ele \xE9 uma trava de banco, pela trigger da
+  -- se\xE7\xE3o 4. Hora j\xE1 paga n\xE3o se corrige sem reabrir a compet\xEAncia.
+  payable_invoice_id uuid,
+  notes             text,
+  metadata          jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at        timestamptz NOT NULL DEFAULT now(),
+  updated_at        timestamptz NOT NULL DEFAULT now(),
+  -- A mesma pessoa n\xE3o bate o mesmo evento duas vezes no mesmo instante. \xC9 o
+  -- que torna o replay da migra\xE7\xE3o e o clique duplo no totem inofensivos.
+  UNIQUE (tenant_id, person_id, work_date, kind, punched_at, seq)
+);
+
+COMMENT ON TABLE public.plg_workforce_time_entries IS
+  'A batida, append-only: um EVENTO (entrada, in\xEDcio/fim de intervalo, sa\xEDda), nunca um par edit\xE1vel. '
+  'UPDATE e DELETE s\xE3o recusados por trigger; a corre\xE7\xE3o \xE9 uma linha em plg_workforce_time_adjustments.';
+
+-- "O que foi batido neste per\xEDodo, nesta unidade?" \u2014 a pergunta da aba Registros
+-- de Ponto, que o V1 responde com filtros De/At\xE9/Unidade/Pessoa.
+CREATE INDEX IF NOT EXISTS plg_workforce_time_entries_period_idx
+  ON public.plg_workforce_time_entries (tenant_id, unit_id, work_date, punched_at);
+
+-- "Quais pontos est\xE3o em aberto?" \u2014 20 no tenant medido. Em aberto n\xE3o \xE9 coluna
+-- (seria estado derivado numa tabela append-only): \xE9 o dia em que os eventos de
+-- ABERTURA n\xE3o empatam com os de fechamento. Este \xEDndice serve a metade que a
+-- view varre, e responde sozinho "quem entrou hoje e onde".
+CREATE INDEX IF NOT EXISTS plg_workforce_time_entries_open_idx
+  ON public.plg_workforce_time_entries (tenant_id, person_id, work_date, seq)
+  WHERE kind IN ('clock_in', 'break_end');
+
+-- "O que esta pessoa bateu?" \u2014 a folha individual, e o que a folha de pagamento
+-- soma no fim do m\xEAs.
+CREATE INDEX IF NOT EXISTS plg_workforce_time_entries_person_idx
+  ON public.plg_workforce_time_entries (tenant_id, person_id, work_date DESC);
+
+DROP TRIGGER IF EXISTS plg_workforce_time_entries_updated_at ON public.plg_workforce_time_entries;
+CREATE TRIGGER plg_workforce_time_entries_updated_at
+  BEFORE UPDATE ON public.plg_workforce_time_entries
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+GRANT SELECT, INSERT ON public.plg_workforce_time_entries TO authenticated;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_workforce_time_entries TO service_role;
+
+-- O scaffold \xE9 quem sabe desenhar a pol\xEDtica deste cluster (tenant, unidade,
+-- permiss\xE3o do plugin, escotilhas de compartilhamento). Escrever a policy \xE0 m\xE3o
+-- criaria a segunda regra de autoriza\xE7\xE3o da jornada, que diverge da primeira na
+-- pr\xF3xima mudan\xE7a do scaffold.
+--
+-- \`p_owner_scoping = false\`: a batida n\xE3o tem dono no sentido de "criada por
+-- mim". Quem enxerga ponto de quem \xE9 \`workforce.read\` por unidade.
+SELECT app.scaffold_table('public.plg_workforce_time_entries'::regclass,
+                          'workforce.time_entry', 'workforce', false, 'enforce');
+
+-- \u2500\u2500 append-only, das duas formas \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O scaffold acabou de criar policies de UPDATE e DELETE, porque \xE9 isso que ele
+-- faz em toda tabela. Aqui elas n\xE3o deveriam existir: apagar batida \xE9 o que a
+-- lei n\xE3o permite. As duas defesas s\xE3o deliberadamente redundantes \u2014 a policy
+-- some para quem entra por \`authenticated\`, e a trigger pega tamb\xE9m service_role
+-- e qualquer SECURITY DEFINER esquecido.
+DROP POLICY IF EXISTS plg_workforce_time_entries_authz_update ON public.plg_workforce_time_entries;
+DROP POLICY IF EXISTS plg_workforce_time_entries_authz_delete ON public.plg_workforce_time_entries;
+
+CREATE OR REPLACE FUNCTION public.plg_workforce_time_entries_append_only()
+  RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+BEGIN
+  -- A escotilha \xE9 a mesma que o resto do cluster usa: durante uma onda de
+  -- migra\xE7\xE3o o motor marca a sess\xE3o, e s\xF3 ela pode reescrever a linha que ela
+  -- mesma acabou de trazer. Fora disso n\xE3o h\xE1 caminho.
+  IF coalesce(current_setting('migration.writer', true), '') = 'on' THEN
+    RETURN CASE TG_OP WHEN 'DELETE' THEN OLD ELSE NEW END;
+  END IF;
+  RAISE EXCEPTION 'plg_workforce_time_entries \xE9 append-only (% recusado) \u2014 corrija pelo ajuste, que \xE9 uma linha com autor e motivo', TG_OP
+    USING ERRCODE = '42501',
+          HINT = 'INSERT em plg_workforce_time_adjustments (action correct|insert|void) exige workforce.adjust_time.';
+END $$;
+
+DROP TRIGGER IF EXISTS plg_workforce_time_entries_append_only ON public.plg_workforce_time_entries;
+CREATE TRIGGER plg_workforce_time_entries_append_only
+  BEFORE UPDATE OR DELETE ON public.plg_workforce_time_entries
+  FOR EACH ROW EXECUTE FUNCTION public.plg_workforce_time_entries_append_only();
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 3. O AJUSTE \xE9 uma linha, n\xE3o uma coluna
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- O V1 guarda o ajuste como quatro colunas na pr\xF3pria batida
+-- (\`checkin_adjusted_at\`, \`checkout_adjusted_at\`, \`adjustment_reason\`,
+-- \`adjusted_by_*\`) \u2014 o que j\xE1 \xE9 melhor que sobrescrever, e \xE9 a parte boa do
+-- modelo dele: *"Os hor\xE1rios reais dos batimentos s\xE3o preservados."* O que ele
+-- n\xE3o tem \xE9 HIST\xD3RICO: o segundo ajuste apaga o primeiro, e ningu\xE9m consegue
+-- dizer quantas vezes aquela hora mudou nem por quem.
+--
+-- Tr\xEAs a\xE7\xF5es, porque o V1 faz as tr\xEAs e chama todas de "ajustar":
+--   correct \u2014 a hora \xE9 outra (o caso comum)
+--   insert  \u2014 faltou a batida (o "esqueceu de bater a sa\xEDda" do V1; a batida
+--             nova entra em plg_workforce_time_entries com origin 'manual' e
+--             esta linha \xE9 quem carrega o autor e o motivo dela)
+--   void    \u2014 esta batida n\xE3o conta (o clique duplo, o totem testado). N\xE3o \xE9
+--             DELETE: a linha fica, marcada, porque sumir com prova \xE9 o que o
+--             append-only existe para impedir.
+CREATE TABLE IF NOT EXISTS public.plg_workforce_time_adjustments (
+  id                   uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id            uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id              uuid REFERENCES app.units(id),
+  time_entry_id        uuid NOT NULL
+                       REFERENCES public.plg_workforce_time_entries(id) ON DELETE CASCADE,
+  action               text NOT NULL CHECK (action IN ('correct', 'insert', 'void')),
+  -- A hora que passa a valer. Obrigat\xF3ria em correct/insert e sem sentido em
+  -- void \u2014 a constraint diz isso em vez de deixar para a tela lembrar.
+  effective_at         timestamptz,
+  -- No V1 o motivo \xE9 OPCIONAL ("Motivo (opcional)"), e \xE9 por isso que ningu\xE9m
+  -- sabe por que 20 pontos foram mexidos. Aqui \xE9 NOT NULL: um ajuste sem motivo
+  -- registrado \xE9 indistingu\xEDvel de uma fraude bem-educada.
+  reason               text NOT NULL,
+  adjusted_by_user_id  uuid,
+  -- O nome de quem ajustou, congelado \u2014 mesma raz\xE3o de \`person_name\`.
+  adjusted_by_name     text,
+  metadata             jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at           timestamptz NOT NULL DEFAULT now(),
+  updated_at           timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_workforce_time_adjustments_effective_check
+    CHECK ((action = 'void' AND effective_at IS NULL) OR (action <> 'void' AND effective_at IS NOT NULL)),
+  CONSTRAINT plg_workforce_time_adjustments_reason_check
+    CHECK (btrim(reason) <> '')
+);
+
+COMMENT ON TABLE public.plg_workforce_time_adjustments IS
+  'O ajuste de ponto como LINHA, com autor e motivo obrigat\xF3rio. O V1 guarda isso em colunas da pr\xF3pria batida e perde o hist\xF3rico no segundo ajuste; aqui cada corre\xE7\xE3o fica, e a hora que vale \xE9 a da \xFAltima n\xE3o anulada.';
+
+-- "Qual a hora que vale nesta batida?" \u2014 a view da se\xE7\xE3o 7 pergunta isso uma vez
+-- por batida, e \xE9 o caminho quente da folha de ponto inteira.
+CREATE INDEX IF NOT EXISTS plg_workforce_time_adjustments_entry_idx
+  ON public.plg_workforce_time_adjustments (time_entry_id, created_at DESC);
+
+DROP TRIGGER IF EXISTS plg_workforce_time_adjustments_updated_at ON public.plg_workforce_time_adjustments;
+CREATE TRIGGER plg_workforce_time_adjustments_updated_at
+  BEFORE UPDATE ON public.plg_workforce_time_adjustments
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_workforce_time_adjustments TO authenticated, service_role;
+
+SELECT app.scaffold_table('public.plg_workforce_time_adjustments'::regclass,
+                          'workforce.time_adjustment', 'workforce', false, 'enforce');
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 4. A COMPET\xCANCIA (lacuna a)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Mesmo desenho de \`plg_financial_periods\` (plugin-financial/006), de
+-- prop\xF3sito: a empresa fecha UM m\xEAs, e ter dois calend\xE1rios de fechamento com
+-- regras diferentes \u2014 um do dinheiro e outro das horas \u2014 \xE9 como n\xE3o ter
+-- fechamento nenhum, porque a pergunta "fevereiro est\xE1 fechado?" passa a ter
+-- duas respostas.
+CREATE TABLE IF NOT EXISTS public.plg_workforce_periods (
+  id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id           uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  -- A compet\xEAncia \xE9 do TENANT, n\xE3o da unidade: fechar o m\xEAs \xE9 um ato de
+  -- empresa, e um m\xEAs meio fechado \xE9 a pior resposta para quem precisa dizer ao
+  -- contador que acabou. A coluna existe porque o scaffold precisa dela.
+  unit_id             uuid REFERENCES app.units(id),
+  -- Sempre o dia 1\xBA, por constraint e n\xE3o por conven\xE7\xE3o de quem escreve.
+  competence_month    date NOT NULL,
+  status              text NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'closed')),
+  closed_at           timestamptz,
+  closed_by_user_id   uuid,
+  reopened_at         timestamptz,
+  reopened_by_user_id uuid,
+  -- Reabrir sem dizer por qu\xEA \xE9 como n\xE3o ter fechado. Obrigat\xF3rio na RPC; a
+  -- coluna aceita nulo porque um per\xEDodo nunca reaberto n\xE3o tem um.
+  reopen_reason       text,
+  -- O que o fechamento virou no financeiro, quando virou. A folha \xE9 uma conta a
+  -- pagar como outra qualquer, e a classifica\xE7\xE3o dela mora aqui porque \xE9 o
+  -- fechamento \u2014 n\xE3o a batida \u2014 que produz o lan\xE7amento.
+  payable_invoice_id  uuid,
+  chart_account_id    uuid,
+  cost_center_id      uuid,
+  notes               text,
+  metadata            jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at          timestamptz NOT NULL DEFAULT now(),
+  updated_at          timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_workforce_periods_first_of_month_check
+    CHECK (competence_month = date_trunc('month', competence_month)::date),
+  CONSTRAINT plg_workforce_periods_tenant_month_key UNIQUE (tenant_id, competence_month)
+);
+
+COMMENT ON TABLE public.plg_workforce_periods IS
+  'Compet\xEAncia mensal da jornada e seu estado. Fechada = nenhuma batida nem ajuste entra com data naquele m\xEAs. Escrita s\xF3 por workforce_period_close/reopen.';
+
+-- A trava consulta "este m\xEAs est\xE1 fechado?" a cada batida: \xEDndice parcial.
+CREATE INDEX IF NOT EXISTS plg_workforce_periods_closed_idx
+  ON public.plg_workforce_periods (tenant_id, competence_month) WHERE status = 'closed';
+
+DROP TRIGGER IF EXISTS plg_workforce_periods_updated_at ON public.plg_workforce_periods;
+CREATE TRIGGER plg_workforce_periods_updated_at
+  BEFORE UPDATE ON public.plg_workforce_periods
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+GRANT SELECT ON public.plg_workforce_periods TO authenticated;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_workforce_periods TO service_role;
+
+SELECT app.scaffold_table('public.plg_workforce_periods'::regclass,
+                          'workforce.period', 'workforce', false, 'enforce');
+
+-- ESCREVER \xC9 S\xD3 PELA RPC. Fechar e reabrir s\xE3o ATOS, n\xE3o edi\xE7\xF5es de linha, e o
+-- ato \xE9 onde a permiss\xE3o e o registro de QUEM moram. Uma policy de UPDATE aqui
+-- seria a porta dos fundos da trava \u2014 \xE9 a mesma decis\xE3o do financeiro/006.
+DROP POLICY IF EXISTS plg_workforce_periods_authz_insert ON public.plg_workforce_periods;
+DROP POLICY IF EXISTS plg_workforce_periods_authz_update ON public.plg_workforce_periods;
+DROP POLICY IF EXISTS plg_workforce_periods_authz_delete ON public.plg_workforce_periods;
+
+CREATE OR REPLACE FUNCTION public.plg_workforce_period_is_closed(p_tenant uuid, p_date date)
+  RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM public.plg_workforce_periods p
+     WHERE p.tenant_id = p_tenant
+       AND p.status = 'closed'
+       AND p.competence_month = date_trunc('month', p_date)::date);
+$$;
+
+COMMENT ON FUNCTION public.plg_workforce_period_is_closed(uuid, date) IS
+  'O m\xEAs desta data est\xE1 fechado para a jornada deste tenant?';
+
+-- \u2500\u2500 a trava sobre a batida \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.trg_workforce_refuse_closed_period()
+  RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE
+  v_date date;
+BEGIN
+  -- Uma onda de migra\xE7\xE3o traz o passado inteiro, e o passado inteiro est\xE1 em
+  -- meses que o V1 j\xE1 tratou como encerrados. Fechar por cima do que ainda est\xE1
+  -- chegando seria fechar antes de existir.
+  IF coalesce(current_setting('migration.writer', true), '') = 'on' THEN
+    RETURN NEW;
+  END IF;
+
+  -- A data que conta \xE9 a da JORNADA, n\xE3o a de cria\xE7\xE3o da linha.
+  IF TG_TABLE_NAME = 'plg_workforce_time_entries' THEN
+    v_date := NEW.work_date;
+  ELSE
+    SELECT e.work_date INTO v_date
+      FROM public.plg_workforce_time_entries e WHERE e.id = NEW.time_entry_id;
+  END IF;
+
+  IF v_date IS NOT NULL AND public.plg_workforce_period_is_closed(NEW.tenant_id, v_date) THEN
+    RAISE EXCEPTION 'a compet\xEAncia de % est\xE1 fechada \u2014 reabra o per\xEDodo para lan\xE7ar nela', to_char(v_date, 'MM/YYYY')
+      USING ERRCODE = '23514',
+            HINT = 'workforce_period_reopen(date_trunc(''month'', data)::date, ''motivo'') exige workforce.close_period.';
+  END IF;
+
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS plg_workforce_time_entries_refuse_closed_period ON public.plg_workforce_time_entries;
+CREATE TRIGGER plg_workforce_time_entries_refuse_closed_period
+  BEFORE INSERT ON public.plg_workforce_time_entries
+  FOR EACH ROW EXECUTE FUNCTION public.trg_workforce_refuse_closed_period();
+
+DROP TRIGGER IF EXISTS plg_workforce_time_adjustments_refuse_closed_period ON public.plg_workforce_time_adjustments;
+CREATE TRIGGER plg_workforce_time_adjustments_refuse_closed_period
+  BEFORE INSERT OR UPDATE ON public.plg_workforce_time_adjustments
+  FOR EACH ROW EXECUTE FUNCTION public.trg_workforce_refuse_closed_period();
+
+-- \u2500\u2500 a segunda trava do V1, agora no banco \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- No V1, batida com \`payable_invoice_id\` preenchido n\xE3o pode ser ajustada \u2014 e a
+-- regra vive no componente que esconde o bot\xE3o. Aqui ela vive onde n\xE3o d\xE1 para
+-- contornar. A linha migrada \xE9 coberta pela mesma trava: o V1 aponta para uma
+-- tabela de t\xEDtulos cuja contraparte no V2 n\xE3o \xE9 a mesma coisa (ver a nota do
+-- de-para), ent\xE3o a refer\xEAncia crua fica em \`metadata.v1.payable_invoice_id\` \u2014 e
+-- basta ela existir para a hora estar travada.
+CREATE OR REPLACE FUNCTION public.trg_workforce_refuse_settled_adjustment()
+  RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE
+  v_entry public.plg_workforce_time_entries%ROWTYPE;
+BEGIN
+  IF coalesce(current_setting('migration.writer', true), '') = 'on' THEN
+    RETURN NEW;
+  END IF;
+  SELECT * INTO v_entry FROM public.plg_workforce_time_entries WHERE id = NEW.time_entry_id;
+  IF v_entry.payable_invoice_id IS NOT NULL
+     OR (v_entry.metadata #>> '{v1,payable_invoice_id}') IS NOT NULL THEN
+    RAISE EXCEPTION 'esta batida j\xE1 virou t\xEDtulo a pagar \u2014 a hora paga n\xE3o se corrige sem estornar o t\xEDtulo'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NOT app.has_permission('workforce.adjust_time', v_entry.unit_id) THEN
+    RAISE EXCEPTION 'ajustar ponto exige workforce.adjust_time' USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS plg_workforce_time_adjustments_refuse_settled ON public.plg_workforce_time_adjustments;
+CREATE TRIGGER plg_workforce_time_adjustments_refuse_settled
+  BEFORE INSERT ON public.plg_workforce_time_adjustments
+  FOR EACH ROW EXECUTE FUNCTION public.trg_workforce_refuse_settled_adjustment();
+
+-- \u2500\u2500 fechar e reabrir \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.workforce_period_close(p_month date, p_notes text DEFAULT NULL)
+  RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_month  date := date_trunc('month', p_month)::date;
+  v_open   bigint;
+  v_row    public.plg_workforce_periods%ROWTYPE;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'workforce_period_close: sem tenant na sess\xE3o' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('workforce.close_period', NULL) THEN
+    RAISE EXCEPTION 'workforce_period_close: exige workforce.close_period' USING ERRCODE = '42501';
+  END IF;
+  IF v_month > date_trunc('month', current_date)::date THEN
+    RAISE EXCEPTION 'workforce_period_close: % ainda n\xE3o terminou', to_char(v_month, 'MM/YYYY')
+      USING ERRCODE = '22023';
+  END IF;
+
+  -- Ponto em aberto \xE9 jornada que ainda vai mudar. Fechar por cima produz um
+  -- total de horas que muda depois de fechado, que \xE9 exatamente o que a trava
+  -- existe para impedir \u2014 e \xE9 o defeito medido no V1: 20 batimentos em aberto
+  -- fazem o valor do per\xEDodo (R$ 47.747) ser um n\xFAmero menor que o real.
+  SELECT count(*) INTO v_open
+    FROM public.v_workforce_day d
+   WHERE d.tenant_id = v_tenant
+     AND d.is_open
+     AND date_trunc('month', d.work_date)::date <= v_month;
+  IF v_open > 0 THEN
+    RAISE EXCEPTION 'workforce_period_close: % ponto(s) em aberto em % ou antes \u2014 feche ou ajuste antes', v_open, to_char(v_month, 'MM/YYYY')
+      USING ERRCODE = '23514',
+            HINT = 'SELECT * FROM public.v_workforce_day WHERE is_open;';
+  END IF;
+
+  INSERT INTO public.plg_workforce_periods (tenant_id, competence_month, status, closed_at, closed_by_user_id, notes)
+  VALUES (v_tenant, v_month, 'closed', now(), auth.uid(), p_notes)
+  ON CONFLICT (tenant_id, competence_month) DO UPDATE
+    SET status = 'closed', closed_at = now(), closed_by_user_id = auth.uid(),
+        notes = coalesce(EXCLUDED.notes, public.plg_workforce_periods.notes), updated_at = now()
+  RETURNING * INTO v_row;
+
+  RETURN jsonb_build_object('period_id', v_row.id, 'competence_month', v_month,
+                            'status', 'closed', 'closed_at', v_row.closed_at);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.workforce_period_reopen(p_month date, p_reason text)
+  RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_month  date := date_trunc('month', p_month)::date;
+  v_row    public.plg_workforce_periods%ROWTYPE;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'workforce_period_reopen: sem tenant na sess\xE3o' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('workforce.close_period', NULL) THEN
+    RAISE EXCEPTION 'workforce_period_reopen: exige workforce.close_period' USING ERRCODE = '42501';
+  END IF;
+  IF nullif(btrim(coalesce(p_reason, '')), '') IS NULL THEN
+    RAISE EXCEPTION 'workforce_period_reopen: o motivo \xE9 obrigat\xF3rio' USING ERRCODE = '22023';
+  END IF;
+
+  UPDATE public.plg_workforce_periods SET
+    status = 'open', reopened_at = now(), reopened_by_user_id = auth.uid(),
+    reopen_reason = p_reason, updated_at = now()
+  WHERE tenant_id = v_tenant AND competence_month = v_month
+  RETURNING * INTO v_row;
+
+  IF v_row.id IS NULL THEN
+    RAISE EXCEPTION 'workforce_period_reopen: % nunca foi fechado', to_char(v_month, 'MM/YYYY')
+      USING ERRCODE = 'P0002';
+  END IF;
+
+  RETURN jsonb_build_object('period_id', v_row.id, 'competence_month', v_month,
+                            'status', 'open', 'reopened_at', v_row.reopened_at, 'reason', p_reason);
+END $$;
+
+REVOKE ALL ON FUNCTION public.workforce_period_close(date, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.workforce_period_reopen(date, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.workforce_period_close(date, text) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.workforce_period_reopen(date, text) TO authenticated;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 5. A ESCALA: o molde
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedule_templates (
+  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id   uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  -- No V1 o template \xE9 POR UNIDADE (o editor abre com um seletor de Unidade), e
+  -- aqui tamb\xE9m: "Almo\xE7o Seg. a Sex." da matriz n\xE3o \xE9 o da filial.
+  unit_id     uuid REFERENCES app.units(id),
+  name        text NOT NULL,
+  is_active   boolean NOT NULL DEFAULT true,
+  notes       text,
+  metadata    jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  updated_at  timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE public.plg_workforce_schedule_templates IS
+  'O molde da escala. Pr\xE9-requisito duro no V1: sem template n\xE3o se cria escala nenhuma \u2014 "Selecione um template de escala acima para come\xE7ar."';
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedule_shifts (
+  id                uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id         uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id           uuid REFERENCES app.units(id),
+  template_id       uuid NOT NULL
+                    REFERENCES public.plg_workforce_schedule_templates(id) ON DELETE CASCADE,
+  label             text NOT NULL,
+  start_time        time NOT NULL,
+  end_time          time NOT NULL,
+  -- 0 = domingo, como \`extract(dow)\` e como \`public.schedules.day_of_week\`.
+  -- A constraint existe porque um 7 solto num array \xE9 um turno que nunca
+  -- acontece e que ningu\xE9m percebe faltando.
+  weekdays          smallint[] NOT NULL DEFAULT '{}'::smallint[],
+  -- Turno que vira o dia (16:00\u201302:00) \xE9 normal em restaurante, e \xE9 a raz\xE3o de
+  -- \`work_date\` ser coluna na batida. Guardar a travessia aqui evita que cada
+  -- leitor redescubra \`end_time < start_time\` \xE0 sua maneira.
+  crosses_midnight  boolean NOT NULL GENERATED ALWAYS AS (end_time <= start_time) STORED,
+  sort_order        integer NOT NULL DEFAULT 0,
+  -- O padr\xE3o de onde a hora deste turno custa. A batida copia e pode divergir.
+  -- FK condicional no fim do arquivo, como nas outras duas tabelas.
+  chart_account_id  uuid,
+  cost_center_id    uuid,
+  metadata          jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at        timestamptz NOT NULL DEFAULT now(),
+  updated_at        timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_workforce_schedule_shifts_weekdays_check
+    CHECK (weekdays <@ ARRAY[0,1,2,3,4,5,6]::smallint[])
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedule_requirements (
+  id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id       uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id         uuid REFERENCES app.units(id),
+  shift_id        uuid NOT NULL
+                  REFERENCES public.plg_workforce_schedule_shifts(id) ON DELETE CASCADE,
+  -- Texto, e n\xE3o FK para um cadastro de profiss\xE3o: no V1 isto \xE9 o nome livre que
+  -- a tela mostra ("Gar\xE7om (1/1)", "Cozinha (0/3)"), e o V2 ainda n\xE3o tem o
+  -- cadastro de profiss\xE3o que seria o destino honesto. Inventar a FK agora seria
+  -- criar um cadastro a partir de dado sujo; o texto atravessa e fica audit\xE1vel.
+  profession_name text NOT NULL,
+  required_count  integer NOT NULL DEFAULT 1 CHECK (required_count > 0),
+  metadata        jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (shift_id, profession_name)
+);
+
+COMMENT ON COLUMN public.plg_workforce_schedule_requirements.required_count IS
+  'A lota\xE7\xE3o da fun\xE7\xE3o no turno \u2014 o denominador do "Gar\xE7om (1/1)" da tela. \xC9 contra ele que a posi\xE7\xE3o por prioridade vira titular ou stand-by.';
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedule_template_assignments (
+  id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id       uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id         uuid REFERENCES app.units(id),
+  template_id     uuid NOT NULL
+                  REFERENCES public.plg_workforce_schedule_templates(id) ON DELETE CASCADE,
+  shift_id        uuid NOT NULL
+                  REFERENCES public.plg_workforce_schedule_shifts(id) ON DELETE CASCADE,
+  profession_name text NOT NULL,
+  person_id       uuid NOT NULL REFERENCES public.people(id) ON DELETE CASCADE,
+  -- COLUNA, e n\xE3o posi\xE7\xE3o. No V1 titular vs stand-by no molde \xE9 impl\xEDcito \u2014 s\xE3o
+  -- titulares os primeiros \`required_count\` por \`priority\` \u2014 e essa regra s\xF3
+  -- existe no c\xF3digo da tela. Aqui ela \xE9 calculada uma vez, na entrada, e fica
+  -- escrita: a mesma verdade que a inst\xE2ncia j\xE1 grava.
+  role            text NOT NULL DEFAULT 'titular' CHECK (role IN ('titular', 'standby')),
+  priority        integer NOT NULL DEFAULT 0,
+  metadata        jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (shift_id, profession_name, person_id)
+);
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 6. A ESCALA: a inst\xE2ncia do dia
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedules (
+  id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id           uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id             uuid REFERENCES app.units(id),
+  schedule_date       date NOT NULL,
+  -- SET NULL e n\xE3o CASCADE: apagar o molde n\xE3o pode apagar a escala de ter\xE7a
+  -- passada, que \xE9 registro de quem trabalhou. A c\xF3pia do turno j\xE1 est\xE1 no
+  -- snapshot da atribui\xE7\xE3o, ent\xE3o a escala sobrevive sozinha ao molde.
+  template_id         uuid REFERENCES public.plg_workforce_schedule_templates(id) ON DELETE SET NULL,
+  status              text NOT NULL DEFAULT 'draft'
+                      CHECK (status IN ('draft', 'published', 'closed')),
+  published_at        timestamptz,
+  published_by_user_id uuid,
+  is_special_day      boolean NOT NULL DEFAULT false,
+  special_day_label   text,
+  notes               text,
+  metadata            jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at          timestamptz NOT NULL DEFAULT now(),
+  updated_at          timestamptz NOT NULL DEFAULT now(),
+  -- Publicada sem carimbo de quando \xE9 uma escala que ningu\xE9m consegue provar
+  -- ter avisado \u2014 e avisar \xE9 a \xFAnica coisa que a publica\xE7\xE3o faz.
+  CONSTRAINT plg_workforce_schedules_published_check
+    CHECK (status <> 'published' OR published_at IS NOT NULL)
+);
+
+-- "Qual a escala deste dia?" \u2014 \xE9 o clique do calend\xE1rio, e \xE9 a consulta que a
+-- tela faz primeiro em toda sess\xE3o.
+CREATE INDEX IF NOT EXISTS plg_workforce_schedules_day_idx
+  ON public.plg_workforce_schedules (tenant_id, unit_id, schedule_date DESC, status);
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_schedule_assignments (
+  id                uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id         uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id           uuid REFERENCES app.units(id),
+  schedule_id       uuid NOT NULL
+                    REFERENCES public.plg_workforce_schedules(id) ON DELETE CASCADE,
+  -- A refer\xEAncia ao turno do molde \xE9 conveni\xEAncia, n\xE3o depend\xEAncia: o snapshot
+  -- abaixo \xE9 quem manda. Por isso SET NULL.
+  shift_id          uuid REFERENCES public.plg_workforce_schedule_shifts(id) ON DELETE SET NULL,
+  -- SNAPSHOT, copiado na cria\xE7\xE3o da escala, exatamente como o V1 faz. Mudar o
+  -- molde n\xE3o pode reescrever a escala de anteontem: o que a pessoa foi chamada
+  -- para cumprir \xE9 um fato daquele dia, e \xE9 contra ESTE hor\xE1rio que o ponto dela
+  -- \xE9 conferido.
+  shift_label       text,
+  shift_start_time  time,
+  shift_end_time    time,
+  profession_name   text,
+  person_id         uuid NOT NULL REFERENCES public.people(id) ON DELETE RESTRICT,
+  role              text NOT NULL DEFAULT 'titular' CHECK (role IN ('titular', 'standby')),
+  priority          integer NOT NULL DEFAULT 0,
+  status            text NOT NULL DEFAULT 'pending'
+                    CHECK (status IN ('pending', 'notified', 'confirmed', 'declined', 'realized')),
+  -- O convite que sai por link, sem sess\xE3o. \xDAnico no tenant porque \xE9 uma
+  -- credencial: dois convites com o mesmo token s\xE3o duas pessoas confirmando
+  -- pelo mesmo endere\xE7o.
+  response_token    text,
+  response_channel  text,
+  notified_at       timestamptz,
+  responded_at      timestamptz,
+  -- A PONTE COM A AGENDA, e a raz\xE3o de a escala n\xE3o morar l\xE1. O RH oferta; ao
+  -- publicar, a atribui\xE7\xE3o materializa uma linha de \`public.schedules\` com
+  -- kind 'work_shift' e a agenda consome. A coluna \xE9 o que torna o cruzamento
+  -- previsto \xD7 realizado uma chave em vez de um casamento por nome e hora.
+  schedule_row_id   uuid REFERENCES public.schedules(id) ON DELETE SET NULL,
+  metadata          jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at        timestamptz NOT NULL DEFAULT now(),
+  updated_at        timestamptz NOT NULL DEFAULT now(),
+  -- A mesma pessoa n\xE3o ocupa a mesma vaga duas vezes no mesmo dia. No V1 nada
+  -- impede, e o resultado \xE9 a lota\xE7\xE3o "2/1" que a tela n\xE3o sabe desenhar.
+  UNIQUE (schedule_id, shift_id, profession_name, person_id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS plg_workforce_schedule_assignments_token_uq
+  ON public.plg_workforce_schedule_assignments (tenant_id, response_token)
+  WHERE response_token IS NOT NULL;
+
+-- "Quem est\xE1 escalado hoje, e quem ainda n\xE3o respondeu?" \u2014 os contadores
+-- "N titulares \xB7 N pendentes" do cart\xE3o da escala.
+CREATE INDEX IF NOT EXISTS plg_workforce_schedule_assignments_schedule_idx
+  ON public.plg_workforce_schedule_assignments (schedule_id, role, status);
+
+-- "O que ESTA pessoa tem pela frente?" \u2014 a folha individual e o convite.
+CREATE INDEX IF NOT EXISTS plg_workforce_schedule_assignments_person_idx
+  ON public.plg_workforce_schedule_assignments (tenant_id, person_id, status);
+
+-- O log da atribui\xE7\xE3o: quem mudou o qu\xEA, por qual canal. No V1 \xE9
+-- \`schedule_assignment_logs\`, e \xE9 a \xFAnica parte do modelo de escala dele que j\xE1
+-- nasceu append-only.
+CREATE TABLE IF NOT EXISTS public.plg_workforce_assignment_logs (
+  id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id           uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id             uuid REFERENCES app.units(id),
+  assignment_id       uuid NOT NULL
+                      REFERENCES public.plg_workforce_schedule_assignments(id) ON DELETE CASCADE,
+  from_status         text,
+  to_status           text NOT NULL,
+  channel             text,
+  note                text,
+  changed_by_user_id  uuid,
+  metadata            jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at          timestamptz NOT NULL DEFAULT now(),
+  updated_at          timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS plg_workforce_assignment_logs_assignment_idx
+  ON public.plg_workforce_assignment_logs (assignment_id, created_at DESC);
+
+-- \u2500\u2500 triggers, grants e scaffold das seis tabelas de escala \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Em la\xE7o porque s\xE3o seis vezes a mesma disciplina: o gatilho de updated_at, o
+-- GRANT para os dois pap\xE9is que existem, e o scaffold desenhando a policy. Seis
+-- blocos copiados divergiriam no primeiro dia em que algu\xE9m editasse um s\xF3.
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT * FROM (VALUES
+      ('plg_workforce_schedule_templates',            'workforce.schedule_template'),
+      ('plg_workforce_schedule_shifts',               'workforce.schedule_shift'),
+      ('plg_workforce_schedule_requirements',         'workforce.schedule_requirement'),
+      ('plg_workforce_schedule_template_assignments', 'workforce.schedule_template_assignment'),
+      ('plg_workforce_schedules',                     'workforce.schedule'),
+      ('plg_workforce_schedule_assignments',          'workforce.schedule_assignment'),
+      ('plg_workforce_assignment_logs',               'workforce.assignment_log')
+    ) AS t(tbl, resource)
+  LOOP
+    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', r.tbl || '_updated_at', r.tbl);
+    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()',
+                   r.tbl || '_updated_at', r.tbl);
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON public.%I TO authenticated, service_role', r.tbl);
+    PERFORM app.scaffold_table(format('public.%I', r.tbl)::regclass, r.resource, 'workforce', false, 'enforce');
+  END LOOP;
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 7. O CRUZAMENTO previsto \xD7 realizado (lacuna b)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+-- A hora que VALE em cada batida: a \xFAltima corre\xE7\xE3o n\xE3o anulada, ou o hor\xE1rio
+-- real. \xC9 a leitura que substitui as colunas \`*_adjusted_at\` do V1 sem perder a
+-- propriedade que o V1 acertou \u2014 o hor\xE1rio real continua ali, intocado.
+--
+-- \`security_invoker\` em todas as views desta se\xE7\xE3o: uma folha de ponto que
+-- ignora escopo \xE9 um vazamento com totais.
+-- REPLAY: \`DROP\` e depois \`CREATE\`, e n\xE3o \`CREATE OR REPLACE\`.
+--
+-- As migrations 003/004/005 ACRESCENTAM colunas a esta view. Acrescentar,
+-- \`CREATE OR REPLACE\` faz; TIRAR, n\xE3o faz \u2014 e \xE9 o que a baseline faria numa
+-- segunda passada, porque a vers\xE3o dela \xE9 a estreita. O cluster devolve
+-- \`42P16: cannot drop columns from view\` e a corrente para aqui.
+--
+-- Conferido em \`pg_depend\` antes de derrubar: nada pende destas duas views,
+-- ent\xE3o o \`DROP\` \xE9 sem \`CASCADE\` \u2014 de prop\xF3sito. Sem ele, o dia em que
+-- algu\xE9m construir sobre elas o \`DROP\` falha alto em vez de levar junto.
+-- Na ordem da depend\xEAncia: \`v_workforce_day\` \xE9 constru\xEDda SOBRE esta, ent\xE3o
+-- sai primeiro. Sem isso o \`DROP\` de baixo recusa \u2014 e recusar \xE9 o certo,
+-- foi assim que esta depend\xEAncia apareceu.
+DROP VIEW IF EXISTS public.v_workforce_day;
+DROP VIEW IF EXISTS public.v_workforce_time_entries;
+CREATE VIEW public.v_workforce_time_entries
+WITH (security_invoker = 'true') AS
+SELECT e.id,
+       e.tenant_id,
+       e.unit_id,
+       e.person_id,
+       e.person_name,
+       e.kind,
+       e.work_date,
+       e.seq,
+       e.origin,
+       e.punched_at,
+       coalesce(c.effective_at, e.punched_at) AS effective_at,
+       (c.id IS NOT NULL)                     AS adjusted,
+       (v.id IS NOT NULL)                     AS voided,
+       c.reason                               AS adjustment_reason,
+       c.adjusted_by_name,
+       e.assignment_id,
+       e.payable_invoice_id,
+       e.evidence,
+       e.metadata
+  FROM public.plg_workforce_time_entries e
+  LEFT JOIN LATERAL (
+    SELECT a.id, a.effective_at, a.reason, a.adjusted_by_name
+      FROM public.plg_workforce_time_adjustments a
+     WHERE a.time_entry_id = e.id AND a.action IN ('correct', 'insert')
+     ORDER BY a.created_at DESC, a.id DESC
+     LIMIT 1) c ON true
+  LEFT JOIN LATERAL (
+    SELECT a.id FROM public.plg_workforce_time_adjustments a
+     WHERE a.time_entry_id = e.id AND a.action = 'void'
+     LIMIT 1) v ON true;
+
+COMMENT ON VIEW public.v_workforce_time_entries IS
+  'A batida com a hora que vale: a \xFAltima corre\xE7\xE3o n\xE3o anulada, ou o hor\xE1rio real. O real (punched_at) nunca some \u2014 \xE9 o que torna o ponto audit\xE1vel.';
+
+-- O dia de trabalho de uma pessoa, previsto ao lado de realizado.
+--
+-- FULL OUTER JOIN de prop\xF3sito. As duas assimetrias s\xE3o exatamente o que o V1
+-- n\xE3o consegue mostrar, e s\xE3o as duas perguntas do RH: previsto sem realizado \xE9
+-- FALTA; realizado sem previsto \xE9 FORA DA ESCALA (que no tenant medido \xE9 o
+-- estado de 325 de 325 registros \u2014 n\xE3o porque as pessoas trabalhem fora da
+-- escala, mas porque o ponto est\xE1 ligado numa unidade e a escala em outra).
+--
+-- As horas trabalhadas saem de uma soma com sinal: clock_out e break_start
+-- FECHAM um trecho, clock_in e break_end ABREM. Quantos intervalos houver no
+-- dia, a conta \xE9 a mesma \u2014 \xE9 isso que o par \xFAnico do V1 n\xE3o consegue fazer.
+-- REPLAY: \`DROP\` e depois \`CREATE\`, e n\xE3o \`CREATE OR REPLACE\`.
+--
+-- As migrations 003/004/005 ACRESCENTAM colunas a esta view. Acrescentar,
+-- \`CREATE OR REPLACE\` faz; TIRAR, n\xE3o faz \u2014 e \xE9 o que a baseline faria numa
+-- segunda passada, porque a vers\xE3o dela \xE9 a estreita. O cluster devolve
+-- \`42P16: cannot drop columns from view\` e a corrente para aqui.
+--
+-- Conferido em \`pg_depend\` antes de derrubar: nada pende destas duas views,
+-- ent\xE3o o \`DROP\` \xE9 sem \`CASCADE\` \u2014 de prop\xF3sito. Sem ele, o dia em que
+-- algu\xE9m construir sobre elas o \`DROP\` falha alto em vez de levar junto.
+DROP VIEW IF EXISTS public.v_workforce_day;
+CREATE VIEW public.v_workforce_day
+WITH (security_invoker = 'true') AS
+WITH realized AS (
+  SELECT e.tenant_id,
+         e.unit_id,
+         e.person_id,
+         e.work_date,
+         min(e.effective_at) FILTER (WHERE e.kind = 'clock_in')  AS first_in,
+         max(e.effective_at) FILTER (WHERE e.kind = 'clock_out') AS last_out,
+         count(*) FILTER (WHERE e.kind = 'break_start')          AS break_count,
+         count(*) FILTER (WHERE e.kind IN ('clock_in', 'break_end'))
+           <> count(*) FILTER (WHERE e.kind IN ('clock_out', 'break_start'))  AS is_open,
+         sum(CASE
+               WHEN e.kind IN ('clock_out', 'break_start') THEN  extract(epoch FROM e.effective_at)
+               WHEN e.kind IN ('clock_in',  'break_end')   THEN -extract(epoch FROM e.effective_at)
+             END) AS worked_seconds
+    FROM public.v_workforce_time_entries e
+   WHERE NOT e.voided
+   GROUP BY e.tenant_id, e.unit_id, e.person_id, e.work_date
+),
+planned AS (
+  SELECT a.tenant_id,
+         a.unit_id,
+         a.person_id,
+         s.schedule_date AS work_date,
+         a.id            AS assignment_id,
+         a.role,
+         a.status        AS assignment_status,
+         a.shift_label,
+         a.shift_start_time,
+         a.shift_end_time,
+         -- O turno que vira o dia \xE9 normal aqui; sem o +24h a jornada da noite
+         -- daria negativa.
+         (extract(epoch FROM a.shift_end_time - a.shift_start_time)
+            + CASE WHEN a.shift_end_time <= a.shift_start_time THEN 86400 ELSE 0 END) AS planned_seconds
+    FROM public.plg_workforce_schedule_assignments a
+    JOIN public.plg_workforce_schedules s ON s.id = a.schedule_id
+   WHERE s.status IN ('published', 'closed')
+     AND a.role = 'titular'
+     AND a.shift_start_time IS NOT NULL
+     AND a.shift_end_time IS NOT NULL
+)
+SELECT coalesce(p.tenant_id, r.tenant_id) AS tenant_id,
+       coalesce(p.unit_id,   r.unit_id)   AS unit_id,
+       coalesce(p.person_id, r.person_id) AS person_id,
+       coalesce(p.work_date, r.work_date) AS work_date,
+       p.assignment_id,
+       p.shift_label,
+       p.shift_start_time,
+       p.shift_end_time,
+       p.assignment_status,
+       (p.planned_seconds / 60)::integer                       AS planned_minutes,
+       (r.worked_seconds  / 60)::integer                       AS worked_minutes,
+       ((r.worked_seconds - p.planned_seconds) / 60)::integer  AS variance_minutes,
+       r.first_in,
+       r.last_out,
+       r.break_count,
+       coalesce(r.is_open, false)                              AS is_open,
+       -- As duas assimetrias, nomeadas. S\xE3o as perguntas do RH, e nenhuma delas
+       -- tem resposta no V1.
+       (r.person_id IS NULL)                                   AS absent,
+       (p.assignment_id IS NULL)                               AS outside_schedule
+  FROM planned p
+  FULL OUTER JOIN realized r
+    ON r.tenant_id = p.tenant_id
+   AND r.person_id = p.person_id
+   AND r.work_date = p.work_date;
+
+COMMENT ON VIEW public.v_workforce_day IS
+  'Jornada prevista \xD7 realizada por pessoa e dia. Previsto vem da escala publicada, realizado das batidas com ajuste aplicado. FULL OUTER JOIN: \`absent\` \xE9 escala sem ponto, \`outside_schedule\` \xE9 ponto sem escala \u2014 as duas perguntas que o V1 n\xE3o responde.';
+
+GRANT SELECT ON public.v_workforce_time_entries TO authenticated, service_role;
+GRANT SELECT ON public.v_workforce_day          TO authenticated, service_role;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 8. OS WRITERS da migra\xE7\xE3o
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+-- O vocabul\xE1rio do de-para \xE9 lista fechada de prop\xF3sito: uma linha que nomeia um
+-- writer inexistente falha na hora, n\xE3o na terceira hora da onda.
+--
+-- ACR\xC9SCIMO, e n\xE3o reemiss\xE3o. A vers\xE3o anterior reescrevia a lista INTEIRA \u2014
+-- "a lista at\xE9 aqui (046) mais os oito da jornada". Uma lista escrita por
+-- extenso \xE9 um retrato: ela apaga todo writer que outro passo registrou e que
+-- o retrato n\xE3o viu. Medido no cluster vivo, re-aplicar esta baseline dava
+--
+--   23514: check constraint "allowlist_writer_check" is violated by some row
+--
+-- porque l\xE1 j\xE1 havia writers que esta lista n\xE3o nomeia. \xC9 o mesmo defeito que
+-- \`agenda/008\` e \`financial/072\` j\xE1 pagaram, e a forma abaixo \xE9 a de
+-- \`inventory/004\`: leia o que existe, acrescente o que falta, nunca reemita.
+DO $$
+DECLARE
+  v_def   text;
+  v_falta text[];
+  v_meus  text[] := ARRAY[
+    'wf_time_entry', 'wf_schedule_template', 'wf_schedule_shift',
+    'wf_schedule_requirement', 'wf_schedule_template_assignment',
+    'wf_schedule', 'wf_schedule_assignment', 'wf_assignment_log'];
+BEGIN
+  SELECT pg_get_constraintdef(oid) INTO v_def
+    FROM pg_constraint WHERE conname = 'allowlist_writer_check';
+
+  IF v_def IS NULL THEN
+    -- Ningu\xE9m escreveu a regra ainda: aqui ela nasce, com os writers desta
+    -- jornada e os que a corrente j\xE1 registrou at\xE9 este ponto.
+    ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check
+      CHECK (writer IS NULL OR writer = ANY (ARRAY[
+        'person', 'unit', 'category', 'product', 'order', 'invoice', 'price_table',
+        'price_table_item', 'package', 'package_item', 'field_rule', 'holiday', 'facet',
+        'fin_account', 'fin_payment_method_type', 'fin_payment_method', 'fin_card_brand',
+        'fin_chart_account', 'fin_cost_center', 'inv_measurement_unit', 'inv_unit_conversion',
+        'inv_location', 'inv_movement', 'order_item', 'fin_movement', 'authz_role',
+        'authz_role_permission', 'person_registration',
+        'fin_recurring_bill', 'fin_recurring_bill_item', 'fin_recurring_bill_occurrence',
+        'wf_time_entry', 'wf_schedule_template', 'wf_schedule_shift', 'wf_schedule_requirement',
+        'wf_schedule_template_assignment', 'wf_schedule', 'wf_schedule_assignment',
+        'wf_assignment_log']));
+    RETURN;
+  END IF;
+
+  SELECT array_agg(w) INTO v_falta
+    FROM unnest(v_meus) AS w
+   WHERE strpos(v_def, '''' || w || '''') = 0;
+
+  IF v_falta IS NULL THEN RETURN; END IF;
+
+  -- Entram na frente do primeiro elemento: a posi\xE7\xE3o n\xE3o importa para um
+  -- \`= ANY\`, e ancorar em \`ARRAY[\` dispensa conhecer qualquer valor da lista
+  -- \u2014 que \xE9 justamente o que n\xE3o se pode presumir.
+  ALTER TABLE migration.allowlist DROP CONSTRAINT allowlist_writer_check;
+  EXECUTE 'ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check '
+       || replace(v_def, 'ARRAY[',
+            'ARRAY[' || (SELECT string_agg(quote_literal(w) || '::text, ', '')
+                           FROM unnest(v_falta) AS w));
+END $$;
+
+-- \u2500\u2500 o de-para da pessoa polim\xF3rfica \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Este helper \xE9 a tradu\xE7\xE3o de \`person_type\` + \`person_id\` para a FK \xFAnica do V2,
+-- e existe uma vez porque quatro writers precisam dela. O ledger \xE9 a \xFAnica fonte
+-- que sabe o de-para, e ele guarda a TABELA de origem \u2014 ent\xE3o 'professional' e
+-- 'employee' resolvem pelo mesmo caminho, e o writer n\xE3o precisa conhecer
+-- nenhuma das duas.
+CREATE OR REPLACE FUNCTION migration._wf_person(p_tenant uuid, p_meta jsonb)
+  RETURNS uuid LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $$
+  SELECT l.target_id
+    FROM migration.ledger l
+   WHERE l.tenant_id = p_tenant
+     AND l.source_table = CASE WHEN (p_meta #>> '{v1,person_type}') = 'professional'
+                               THEN 'professionals' ELSE 'employees' END
+     AND l.source_numeric_id = nullif(p_meta #>> '{v1,person_id}', '')::bigint
+     AND l.target_table = 'public.people'
+     AND l.status = 'migrated'
+   LIMIT 1;
+$$;
+
+COMMENT ON FUNCTION migration._wf_person(uuid, jsonb) IS
+  'person_type + person_id do V1 \u2192 o uuid de public.people. Duas tabelas de cadastro no V1, um cadastro s\xF3 no V2.';
+
+-- Helper de migra\xE7\xE3o l\xEA o ledger inteiro do tenant: n\xE3o \xE9 fun\xE7\xE3o de aplica\xE7\xE3o.
+REVOKE ALL ON FUNCTION migration._wf_person(uuid, jsonb) FROM PUBLIC, anon, authenticated;
+
+-- \u2500\u2500 a batida \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- UMA linha do V1 vira AT\xC9 QUATRO linhas do V2: a entrada, a sa\xEDda (quando
+-- existe), e o ajuste de cada uma (quando \`*_adjusted_at\` est\xE1 preenchido). \xC9 a
+-- tradu\xE7\xE3o do par-com-colunas-de-ajuste para eventos-com-ajuste-em-linha.
+--
+-- Os ids derivados s\xE3o determin\xEDsticos (md5 do id de origem + o sufixo do papel)
+-- para que reoferecer a mesma linha numa segunda passada ATUALIZE em vez de
+-- duplicar o dia de trabalho de algu\xE9m. \`target_id\` devolvido \xE9 o da ENTRADA:
+-- \xE9 a linha do V1 que ela representa.
+CREATE OR REPLACE FUNCTION migration.upsert_wf_time_entry(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_person     uuid;
+  v_unit       uuid := (p_row ->> 'unit_id')::uuid;
+  v_in         timestamptz := (p_row ->> 'checkin_at')::timestamptz;
+  v_out        timestamptz := (p_row ->> 'checkout_at')::timestamptz;
+  v_in_adj     timestamptz := (p_row ->> 'checkin_adjusted_at')::timestamptz;
+  v_out_adj    timestamptz := (p_row ->> 'checkout_adjusted_at')::timestamptz;
+  v_work_date  date;
+  v_out_id     uuid;
+  v_reason     text := coalesce(nullif(btrim(coalesce(p_row ->> 'adjustment_reason', '')), ''),
+                                'ajuste importado do V1 sem motivo registrado');
+  v_evidence   jsonb;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+
+  IF p_id IS NULL OR v_in IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma batida precisa de id e de hora de entrada');
+  END IF;
+
+  -- Recusar \xE9 o certo, e \xE9 tempor\xE1rio: a pessoa entra na mesma onda, e a segunda
+  -- passada oferece a batida de novo. Inventar a pessoa aqui seria pendurar
+  -- horas de trabalho \u2014 e portanto dinheiro \u2014 em quem n\xE3o existe.
+  v_person := migration._wf_person(p_tenant, v_meta);
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('batida de %s #%s cuja pessoa ainda n\xE3o migrou',
+                       coalesce(v_meta #>> '{v1,person_type}', '<sem tipo>'),
+                       coalesce(v_meta #>> '{v1,person_id}', '<sem id>')));
+  END IF;
+
+  -- A jornada \xE9 do dia da ENTRADA, sempre \u2014 mesmo quando a sa\xEDda \xE9 do dia
+  -- seguinte. \xC9 a regra que o V1 admite na caixa de ajuste e nunca grava.
+  v_work_date := coalesce((p_row ->> 'work_date')::date, v_in::date);
+  v_out_id := md5(p_id::text || ':clock_out')::uuid;
+
+  -- Todo o conjunto de prova do totem numa chave s\xF3. Perder qualquer um destes
+  -- campos \xE9 perder a defesa de uma batida contestada.
+  v_evidence := jsonb_strip_nulls(jsonb_build_object(
+    'photo_path', p_row ->> 'checkin_photo_path',
+    'lat',        (p_row ->> 'checkin_lat')::numeric,
+    'lng',        (p_row ->> 'checkin_lng')::numeric,
+    'accuracy_m', (p_row ->> 'checkin_accuracy_m')::numeric,
+    'ip',         p_row ->> 'checkin_ip',
+    'user_agent', p_row ->> 'checkin_user_agent',
+    'face_score', (p_row ->> 'checkin_face_score')::numeric));
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_time_entries WHERE id = p_id) THEN
+    INSERT INTO public.plg_workforce_time_entries
+      (id, tenant_id, unit_id, person_id, person_name, kind, punched_at, work_date, seq,
+       origin, evidence, assignment_id, notes, metadata)
+    VALUES (p_id, p_tenant, v_unit, v_person, p_row ->> 'person_name', 'clock_in', v_in,
+            v_work_date, 1, 'migration', v_evidence,
+            (p_row ->> 'assignment_id')::uuid, p_row ->> 'notes', v_meta);
+    v_created := true;
+  ELSE
+    UPDATE public.plg_workforce_time_entries SET
+      unit_id       = coalesce(v_unit, unit_id),
+      person_id     = v_person,
+      person_name   = coalesce(p_row ->> 'person_name', person_name),
+      punched_at    = v_in,
+      work_date     = v_work_date,
+      evidence      = migration._merge_meta(evidence, v_evidence),
+      assignment_id = coalesce((p_row ->> 'assignment_id')::uuid, assignment_id),
+      notes         = CASE WHEN p_row ? 'notes' THEN p_row ->> 'notes' ELSE notes END,
+      metadata      = migration._merge_meta(metadata, v_meta)
+    WHERE id = p_id;
+  END IF;
+
+  -- A sa\xEDda s\xF3 existe quando existe. \`checkout_at IS NULL\` \xE9 o "ponto em aberto"
+  -- do V1 \u2014 20 deles no tenant medido \u2014 e ele atravessa como aus\xEAncia de evento,
+  -- que \xE9 o que ele \xE9. Fabricar uma sa\xEDda para "fechar" o registro inventaria
+  -- horas trabalhadas.
+  IF v_out IS NOT NULL THEN
+    IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_time_entries WHERE id = v_out_id) THEN
+      INSERT INTO public.plg_workforce_time_entries
+        (id, tenant_id, unit_id, person_id, person_name, kind, punched_at, work_date, seq,
+         origin, evidence, assignment_id, metadata)
+      VALUES (v_out_id, p_tenant, v_unit, v_person, p_row ->> 'person_name', 'clock_out', v_out,
+              v_work_date, 2, 'migration',
+              jsonb_strip_nulls(jsonb_build_object(
+                'photo_path', p_row ->> 'checkout_photo_path',
+                'lat',        (p_row ->> 'checkout_lat')::numeric,
+                'lng',        (p_row ->> 'checkout_lng')::numeric,
+                'accuracy_m', (p_row ->> 'checkout_accuracy_m')::numeric,
+                'ip',         p_row ->> 'checkout_ip',
+                'user_agent', p_row ->> 'checkout_user_agent',
+                'face_score', (p_row ->> 'checkout_face_score')::numeric)),
+              (p_row ->> 'assignment_id')::uuid,
+              migration._deep_set(v_meta, ARRAY['migration', 'derived_from'], to_jsonb(p_id::text)));
+    ELSE
+      UPDATE public.plg_workforce_time_entries SET
+        punched_at = v_out, work_date = v_work_date, person_id = v_person
+      WHERE id = v_out_id;
+    END IF;
+  END IF;
+
+  -- O ajuste vira LINHA. No V1 ele \xE9 um par de colunas por cima da batida, e o
+  -- hist\xF3rico morre no segundo ajuste; aqui cada corre\xE7\xE3o fica, com autor e
+  -- motivo. O motivo \xE9 opcional no V1 e obrigat\xF3rio aqui \u2014 quando vem vazio, o
+  -- texto diz exatamente isso, em vez de fingir que algu\xE9m justificou.
+  IF v_in_adj IS NOT NULL THEN
+    INSERT INTO public.plg_workforce_time_adjustments
+      (id, tenant_id, unit_id, time_entry_id, action, effective_at, reason,
+       adjusted_by_user_id, adjusted_by_name, metadata)
+    VALUES (md5(p_id::text || ':adjust_in')::uuid, p_tenant, v_unit, p_id, 'correct',
+            v_in_adj, v_reason,
+            (p_row ->> 'adjusted_by_user_id')::uuid, p_row ->> 'adjusted_by_name',
+            migration._deep_set(v_meta, ARRAY['migration', 'from'], to_jsonb('checkin_adjusted_at'::text)))
+    ON CONFLICT (id) DO UPDATE
+      SET effective_at = EXCLUDED.effective_at, reason = EXCLUDED.reason,
+          adjusted_by_name = EXCLUDED.adjusted_by_name, updated_at = now();
+  END IF;
+
+  IF v_out_adj IS NOT NULL AND v_out IS NOT NULL THEN
+    INSERT INTO public.plg_workforce_time_adjustments
+      (id, tenant_id, unit_id, time_entry_id, action, effective_at, reason,
+       adjusted_by_user_id, adjusted_by_name, metadata)
+    VALUES (md5(p_id::text || ':adjust_out')::uuid, p_tenant, v_unit, v_out_id, 'correct',
+            v_out_adj, v_reason,
+            (p_row ->> 'adjusted_by_user_id')::uuid, p_row ->> 'adjusted_by_name',
+            migration._deep_set(v_meta, ARRAY['migration', 'from'], to_jsonb('checkout_adjusted_at'::text)))
+    ON CONFLICT (id) DO UPDATE
+      SET effective_at = EXCLUDED.effective_at, reason = EXCLUDED.reason,
+          adjusted_by_name = EXCLUDED.adjusted_by_name, updated_at = now();
+  END IF;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_time_entries', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+    'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END,
+    'entries', CASE WHEN v_out IS NULL THEN 1 ELSE 2 END,
+    'open', v_out IS NULL);
+END $function$;
+
+-- \u2500\u2500 o molde \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule_template(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_name text := nullif(btrim(coalesce(p_row ->> 'name', '')), '');
+  v_created boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_name IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'um template de escala precisa de id e de nome \u2014 \xE9 por ele que a tela o oferece');
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_schedule_templates WHERE id = p_id) THEN
+    INSERT INTO public.plg_workforce_schedule_templates (id, tenant_id, unit_id, name, is_active, notes, metadata)
+    VALUES (p_id, p_tenant, (p_row ->> 'unit_id')::uuid, v_name,
+            coalesce((p_row ->> 'is_active')::boolean, true), p_row ->> 'notes', v_meta);
+    v_created := true;
+  ELSE
+    UPDATE public.plg_workforce_schedule_templates SET
+      unit_id   = CASE WHEN p_row ? 'unit_id' THEN (p_row ->> 'unit_id')::uuid ELSE unit_id END,
+      name      = v_name,
+      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END,
+      notes     = CASE WHEN p_row ? 'notes' THEN p_row ->> 'notes' ELSE notes END,
+      metadata  = migration._merge_meta(metadata, v_meta)
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedule_templates', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+                            'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule_shift(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta     jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_template uuid  := (p_row ->> 'template_id')::uuid;
+  v_start    time  := (p_row ->> 'start_time')::time;
+  v_end      time  := (p_row ->> 'end_time')::time;
+  v_days     smallint[];
+  v_bad      smallint[];
+  v_unit     uuid;
+  v_created  boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_template IS NULL OR v_start IS NULL OR v_end IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'um turno precisa de id, do template, de in\xEDcio e de fim');
+  END IF;
+  SELECT unit_id INTO v_unit FROM public.plg_workforce_schedule_templates
+   WHERE id = v_template AND tenant_id = p_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('o template %s n\xE3o existe neste tenant', v_template));
+  END IF;
+
+  -- Sem corre\xE7\xE3o silenciosa nos dias da semana. Um 7 solto (ou um 1..7 em vez de
+  -- 0..6) \xE9 um turno que nunca acontece, e um turno que nunca acontece \xE9 uma
+  -- pessoa que ningu\xE9m chamou \u2014 some sem erro nenhum.
+  SELECT coalesce(array_agg(x::smallint ORDER BY x), '{}'::smallint[])
+    INTO v_days
+    FROM jsonb_array_elements_text(coalesce(p_row -> 'weekdays', '[]'::jsonb)) AS t(x);
+  SELECT coalesce(array_agg(d), '{}'::smallint[]) INTO v_bad
+    FROM unnest(v_days) AS d WHERE d < 0 OR d > 6;
+  IF array_length(v_bad, 1) > 0 THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('dia da semana fora de 0..6 (domingo..s\xE1bado): %s', v_bad::text));
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_schedule_shifts WHERE id = p_id) THEN
+    INSERT INTO public.plg_workforce_schedule_shifts
+      (id, tenant_id, unit_id, template_id, label, start_time, end_time, weekdays, sort_order, metadata)
+    VALUES (p_id, p_tenant, v_unit, v_template,
+            coalesce(nullif(btrim(coalesce(p_row ->> 'label', '')), ''), 'Turno'),
+            v_start, v_end, v_days, coalesce((p_row ->> 'sort_order')::integer, 0), v_meta);
+    v_created := true;
+  ELSE
+    UPDATE public.plg_workforce_schedule_shifts SET
+      unit_id    = v_unit,
+      label      = coalesce(nullif(btrim(coalesce(p_row ->> 'label', '')), ''), label),
+      start_time = v_start,
+      end_time   = v_end,
+      weekdays   = v_days,
+      sort_order = CASE WHEN p_row ? 'sort_order' THEN coalesce((p_row ->> 'sort_order')::integer, sort_order) ELSE sort_order END,
+      metadata   = migration._merge_meta(metadata, v_meta)
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedule_shifts', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+                            'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END,
+                            'crosses_midnight', v_end <= v_start);
+END $function$;
+
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule_requirement(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta    jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_shift   uuid  := (p_row ->> 'shift_id')::uuid;
+  v_prof    text  := nullif(btrim(coalesce(p_row ->> 'profession_name', '')), '');
+  v_count   integer := coalesce((p_row ->> 'required_count')::integer, 1);
+  v_unit    uuid;
+  v_id      uuid;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_shift IS NULL OR v_prof IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma vaga precisa de id, do turno e do nome da fun\xE7\xE3o');
+  END IF;
+  SELECT unit_id INTO v_unit FROM public.plg_workforce_schedule_shifts
+   WHERE id = v_shift AND tenant_id = p_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('o turno %s n\xE3o existe neste tenant', v_shift));
+  END IF;
+  -- Lota\xE7\xE3o zero ou negativa \xE9 vaga que n\xE3o existe; e a constraint recusaria a
+  -- linha inteira mais tarde, sem dizer qual era.
+  IF v_count <= 0 THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('lota\xE7\xE3o de %L \xE9 %s \u2014 uma vaga precisa de pelo menos uma pessoa', v_prof, v_count));
+  END IF;
+
+  -- Devolve o id da linha que de fato ficou: quando duas vagas do V1 nomeiam a
+  -- mesma fun\xE7\xE3o no mesmo turno, a segunda funde na primeira, e o ledger tem de
+  -- apontar para onde o dado foi parar \u2014 n\xE3o para o id que ela trazia.
+  INSERT INTO public.plg_workforce_schedule_requirements
+    (id, tenant_id, unit_id, shift_id, profession_name, required_count, metadata)
+  VALUES (p_id, p_tenant, v_unit, v_shift, v_prof, v_count, v_meta)
+  ON CONFLICT (shift_id, profession_name) DO UPDATE
+    SET required_count = EXCLUDED.required_count,
+        metadata = migration._merge_meta(public.plg_workforce_schedule_requirements.metadata, EXCLUDED.metadata),
+        updated_at = now()
+  RETURNING id INTO v_id;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedule_requirements', v_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', v_id,
+    'reason', CASE WHEN v_id = p_id THEN 'upserted' ELSE 'fundida na vaga que j\xE1 existia para esta fun\xE7\xE3o neste turno' END);
+END $function$;
+
+-- No molde do V1, titular vs stand-by \xE9 POSICIONAL \u2014 os primeiros
+-- \`required_count\` por \`priority\`. Este writer faz essa conta UMA vez, na
+-- entrada, e grava o resultado em \`role\`. Deixar a regra impl\xEDcita no V2 seria
+-- repor um comportamento que s\xF3 existe no c\xF3digo de uma tela, e que a pr\xF3xima
+-- tela a ler a mesma tabela erraria em sil\xEAncio.
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule_template_assignment(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta     jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_shift    uuid  := (p_row ->> 'shift_id')::uuid;
+  v_prof     text  := nullif(btrim(coalesce(p_row ->> 'profession_name', '')), '');
+  v_priority integer := coalesce((p_row ->> 'priority')::integer, 0);
+  v_person   uuid;
+  v_template uuid;
+  v_unit     uuid;
+  v_required integer;
+  v_rank     integer;
+  v_role     text;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_shift IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma aloca\xE7\xE3o de molde precisa de id e do turno');
+  END IF;
+
+  -- No molde a pessoa \xE9 sempre \`professionals\` \u2014 o V1 n\xE3o escala funcion\xE1rio
+  -- pelo template \u2014 mas o helper resolve pelo que o metadata disser, e n\xE3o pelo
+  -- que este writer sup\xF5e.
+  v_person := migration._wf_person(p_tenant,
+    CASE WHEN (v_meta #>> '{v1,person_type}') IS NULL
+         THEN migration._deep_set(v_meta, ARRAY['v1', 'person_type'], to_jsonb('professional'::text))
+         ELSE v_meta END);
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('aloca\xE7\xE3o de molde cuja pessoa ainda n\xE3o migrou (%s #%s)',
+                       coalesce(v_meta #>> '{v1,person_type}', 'professional'),
+                       coalesce(v_meta #>> '{v1,person_id}', '<sem id>')));
+  END IF;
+
+  SELECT s.template_id, s.unit_id INTO v_template, v_unit
+    FROM public.plg_workforce_schedule_shifts s
+   WHERE s.id = v_shift AND s.tenant_id = p_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('o turno %s n\xE3o existe neste tenant', v_shift));
+  END IF;
+
+  INSERT INTO public.plg_workforce_schedule_template_assignments
+    (id, tenant_id, unit_id, template_id, shift_id, profession_name, person_id, role, priority, metadata)
+  VALUES (p_id, p_tenant, v_unit, v_template, v_shift, coalesce(v_prof, '\u2014'), v_person,
+          'titular', v_priority, v_meta)
+  ON CONFLICT (shift_id, profession_name, person_id) DO UPDATE
+    SET priority = EXCLUDED.priority,
+        metadata = migration._merge_meta(public.plg_workforce_schedule_template_assignments.metadata, EXCLUDED.metadata),
+        updated_at = now();
+
+  -- A POSI\xC7\xC3O vira PAPEL. Recalculada a cada linha porque a ordem muda quando a
+  -- pr\xF3xima chega: a quarta pessoa de uma vaga de tr\xEAs rebaixa ningu\xE9m, mas
+  -- entra como reserva, e a s\xE9tima tamb\xE9m.
+  SELECT r.required_count INTO v_required
+    FROM public.plg_workforce_schedule_requirements r
+   WHERE r.shift_id = v_shift AND r.profession_name = coalesce(v_prof, '\u2014');
+
+  SELECT rank INTO v_rank FROM (
+    SELECT a.id, row_number() OVER (ORDER BY a.priority, a.created_at, a.id) AS rank
+      FROM public.plg_workforce_schedule_template_assignments a
+     WHERE a.shift_id = v_shift AND a.profession_name = coalesce(v_prof, '\u2014')) s
+   WHERE s.id = p_id;
+
+  -- Sem vaga declarada n\xE3o h\xE1 denominador, e chutar um faria a pessoa virar
+  -- titular ou reserva por acaso. \`titular\` \xE9 o que o V1 mostra nesse caso.
+  v_role := CASE WHEN v_required IS NULL THEN 'titular'
+                 WHEN v_rank <= v_required THEN 'titular'
+                 ELSE 'standby' END;
+  UPDATE public.plg_workforce_schedule_template_assignments SET role = v_role WHERE id = p_id;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedule_template_assignments', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'role', v_role,
+    'reason', format('posi\xE7\xE3o %s de %s vaga(s) \u2192 %s', v_rank, coalesce(v_required::text, 'sem lota\xE7\xE3o declarada'), v_role));
+END $function$;
+
+-- \u2500\u2500 a inst\xE2ncia \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta      jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_date      date  := (p_row ->> 'schedule_date')::date;
+  v_status_v1 text  := nullif(btrim(lower(coalesce(p_row ->> 'status', ''))), '');
+  v_status    text;
+  v_published timestamptz := (p_row ->> 'published_at')::timestamptz;
+  v_created   boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_date IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma escala precisa de id e do dia a que pertence');
+  END IF;
+
+  v_status := CASE v_status_v1
+                WHEN 'draft'     THEN 'draft'
+                WHEN 'published' THEN 'published'
+                WHEN 'closed'    THEN 'closed'
+                ELSE NULL END;
+  IF v_status IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('estado de escala desconhecido: %L (o V2 conhece draft, published e closed)', v_status_v1));
+  END IF;
+
+  -- Publicada sem carimbo \xE9 o rascunho do V1 que algu\xE9m marcou como publicado
+  -- sem a a\xE7\xE3o que grava a data. A constraint recusaria; aqui a data de
+  -- publica\xE7\xE3o vira a do pr\xF3prio dia da escala, e o remendo fica escrito.
+  IF v_status <> 'draft' AND v_published IS NULL THEN
+    v_published := v_date::timestamptz;
+    v_meta := migration._deep_set(v_meta, ARRAY['migration', 'published_at_inferred'], to_jsonb(true));
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_schedules WHERE id = p_id) THEN
+    INSERT INTO public.plg_workforce_schedules
+      (id, tenant_id, unit_id, schedule_date, template_id, status, published_at,
+       is_special_day, special_day_label, notes, metadata)
+    VALUES (p_id, p_tenant, (p_row ->> 'unit_id')::uuid, v_date,
+            (p_row ->> 'template_id')::uuid, v_status, v_published,
+            coalesce((p_row ->> 'is_special_day')::boolean, false),
+            p_row ->> 'special_day_label', p_row ->> 'notes', v_meta);
+    v_created := true;
+  ELSE
+    UPDATE public.plg_workforce_schedules SET
+      unit_id           = CASE WHEN p_row ? 'unit_id' THEN (p_row ->> 'unit_id')::uuid ELSE unit_id END,
+      schedule_date     = v_date,
+      template_id       = CASE WHEN p_row ? 'template_id' THEN (p_row ->> 'template_id')::uuid ELSE template_id END,
+      status            = v_status,
+      published_at      = v_published,
+      is_special_day    = CASE WHEN p_row ? 'is_special_day' THEN coalesce((p_row ->> 'is_special_day')::boolean, false) ELSE is_special_day END,
+      special_day_label = CASE WHEN p_row ? 'special_day_label' THEN p_row ->> 'special_day_label' ELSE special_day_label END,
+      notes             = CASE WHEN p_row ? 'notes' THEN p_row ->> 'notes' ELSE notes END,
+      metadata          = migration._merge_meta(metadata, v_meta)
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedules', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+                            'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+CREATE OR REPLACE FUNCTION migration.upsert_wf_schedule_assignment(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_schedule   uuid  := (p_row ->> 'schedule_id')::uuid;
+  v_role_v1    text  := nullif(btrim(lower(coalesce(p_row ->> 'role', ''))), '');
+  v_status_v1  text  := nullif(btrim(lower(coalesce(p_row ->> 'status', ''))), '');
+  v_role       text;
+  v_status     text;
+  v_person     uuid;
+  v_unit       uuid;
+  v_start      time := (p_row ->> 'shift_start_time')::time;
+  v_end        time := (p_row ->> 'shift_end_time')::time;
+  v_created    boolean := false;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_schedule IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma atribui\xE7\xE3o precisa de id e da escala a que pertence');
+  END IF;
+  SELECT unit_id INTO v_unit FROM public.plg_workforce_schedules
+   WHERE id = v_schedule AND tenant_id = p_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('a escala %s n\xE3o existe neste tenant', v_schedule));
+  END IF;
+
+  v_person := migration._wf_person(p_tenant,
+    CASE WHEN (v_meta #>> '{v1,person_type}') IS NULL
+         THEN migration._deep_set(v_meta, ARRAY['v1', 'person_type'], to_jsonb('professional'::text))
+         ELSE v_meta END);
+  IF v_person IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('atribui\xE7\xE3o de escala cuja pessoa ainda n\xE3o migrou (%s #%s)',
+                       coalesce(v_meta #>> '{v1,person_type}', 'professional'),
+                       coalesce(v_meta #>> '{v1,person_id}', '<sem id>')));
+  END IF;
+
+  -- Stand-by N\xC3O \xE9 folga: \xE9 o substituto acion\xE1vel, e a pr\xF3pria tela do V1 diz
+  -- ("Substitutos em caso de falta"). Confundir os dois na tradu\xE7\xE3o apagaria a
+  -- fila de quem cobre a falta.
+  v_role := CASE v_role_v1
+              WHEN 'titular' THEN 'titular'
+              WHEN 'standby' THEN 'standby'
+              WHEN 'stand_by' THEN 'standby'
+              WHEN 'stand-by' THEN 'standby'
+              ELSE NULL END;
+  IF v_role IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('papel na vaga desconhecido: %L (o V2 conhece titular e standby)', v_role_v1));
+  END IF;
+
+  v_status := CASE v_status_v1
+                WHEN 'pending'   THEN 'pending'
+                WHEN 'notified'  THEN 'notified'
+                WHEN 'confirmed' THEN 'confirmed'
+                WHEN 'declined'  THEN 'declined'
+                WHEN 'realized'  THEN 'realized'
+                ELSE NULL END;
+  IF v_status IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
+      'reason', format('estado de atribui\xE7\xE3o desconhecido: %L', v_status_v1));
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_workforce_schedule_assignments WHERE id = p_id) THEN
+    INSERT INTO public.plg_workforce_schedule_assignments
+      (id, tenant_id, unit_id, schedule_id, shift_id, shift_label, shift_start_time, shift_end_time,
+       profession_name, person_id, role, priority, status, response_token, response_channel,
+       notified_at, responded_at, metadata)
+    VALUES (p_id, p_tenant, v_unit, v_schedule, (p_row ->> 'shift_id')::uuid,
+            p_row ->> 'shift_label', v_start, v_end,
+            p_row ->> 'profession_name', v_person, v_role,
+            coalesce((p_row ->> 'priority')::integer, 0), v_status,
+            -- O token do V1 \xE9 uma credencial viva de um canal que o V2 ainda n\xE3o
+            -- opera. Ele atravessa para n\xE3o perder o rastro de quem foi chamado
+            -- por link, mas quem emitir o pr\xF3ximo convite emite outro.
+            p_row ->> 'response_token', p_row ->> 'response_channel',
+            (p_row ->> 'notified_at')::timestamptz, (p_row ->> 'responded_at')::timestamptz,
+            v_meta);
+    v_created := true;
+  ELSE
+    UPDATE public.plg_workforce_schedule_assignments SET
+      unit_id          = v_unit,
+      shift_id         = CASE WHEN p_row ? 'shift_id' THEN (p_row ->> 'shift_id')::uuid ELSE shift_id END,
+      shift_label      = CASE WHEN p_row ? 'shift_label' THEN p_row ->> 'shift_label' ELSE shift_label END,
+      shift_start_time = coalesce(v_start, shift_start_time),
+      shift_end_time   = coalesce(v_end, shift_end_time),
+      profession_name  = CASE WHEN p_row ? 'profession_name' THEN p_row ->> 'profession_name' ELSE profession_name END,
+      person_id        = v_person,
+      role             = v_role,
+      priority         = CASE WHEN p_row ? 'priority' THEN coalesce((p_row ->> 'priority')::integer, priority) ELSE priority END,
+      status           = v_status,
+      response_token   = CASE WHEN p_row ? 'response_token' THEN p_row ->> 'response_token' ELSE response_token END,
+      response_channel = CASE WHEN p_row ? 'response_channel' THEN p_row ->> 'response_channel' ELSE response_channel END,
+      notified_at      = CASE WHEN p_row ? 'notified_at' THEN (p_row ->> 'notified_at')::timestamptz ELSE notified_at END,
+      responded_at     = CASE WHEN p_row ? 'responded_at' THEN (p_row ->> 'responded_at')::timestamptz ELSE responded_at END,
+      metadata         = migration._merge_meta(metadata, v_meta)
+    WHERE id = p_id;
+  END IF;
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_schedule_assignments', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'role', v_role,
+                            'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
+END $function$;
+
+CREATE OR REPLACE FUNCTION migration.upsert_wf_assignment_log(
+  p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $function$
+DECLARE
+  v_meta       jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
+  v_assignment uuid  := (p_row ->> 'assignment_id')::uuid;
+  v_to         text  := nullif(btrim(lower(coalesce(p_row ->> 'to_status', ''))), '');
+  v_unit       uuid;
+  v_standalone boolean := migration._standalone();
+BEGIN
+  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
+  IF p_id IS NULL OR v_assignment IS NULL OR v_to IS NULL THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
+      'reason', 'uma linha de hist\xF3rico precisa de id, da atribui\xE7\xE3o e do estado para o qual foi');
+  END IF;
+  SELECT unit_id INTO v_unit FROM public.plg_workforce_schedule_assignments
+   WHERE id = v_assignment AND tenant_id = p_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
+      'reason', format('a atribui\xE7\xE3o %s n\xE3o existe neste tenant', v_assignment));
+  END IF;
+
+  -- O log \xE9 hist\xF3rico: reoferecer a mesma linha \xE9 replay, e replay n\xE3o reescreve
+  -- o que j\xE1 foi registrado.
+  IF EXISTS (SELECT 1 FROM public.plg_workforce_assignment_logs WHERE id = p_id) THEN
+    RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id,
+                              'reason', 'already in the ledger (append-only)');
+  END IF;
+
+  INSERT INTO public.plg_workforce_assignment_logs
+    (id, tenant_id, unit_id, assignment_id, from_status, to_status, channel, note,
+     changed_by_user_id, metadata, created_at)
+  VALUES (p_id, p_tenant, v_unit, v_assignment,
+          nullif(btrim(lower(coalesce(p_row ->> 'from_status', ''))), ''), v_to,
+          p_row ->> 'channel', p_row ->> 'note',
+          (p_row ->> 'changed_by_user_id')::uuid, v_meta,
+          coalesce((p_row ->> 'created_at')::timestamptz, now()));
+
+  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_workforce_assignment_logs', p_id, '{}'::jsonb); END IF;
+  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', 'created');
+END $function$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 9. O DE-PARA
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+-- \`_allow\` \xE9 o construtor oficial: a allowlist tem gatilho de congelamento, e um
+-- INSERT direto por cima de uma linha \`frozen\` seria recusado. S\xE3o oito
+-- argumentos \u2014 (source, target, domain, writer, writer_args, financial[],
+-- columns, notes) \u2014 e \`layer\` \xE9 fixo em 'core-A' l\xE1 dentro.
+
+-- A allowlist \xE9 CONGELADA (\`trg_allowlist_frozen\`): mudan\xE7a de core-A \xE9
+-- arquivo de migration, n\xE3o escrita solta \u2014 e este \xE9 o arquivo. Sem a
+-- escotilha, a PRIMEIRA passada passa (a linha ainda n\xE3o existia) e a
+-- SEGUNDA falha: \xE9 assim que uma migration deixa de ser replay-safe sem
+-- ningu\xE9m ver. \`true\` no terceiro argumento: vale s\xF3 nesta transa\xE7\xE3o.
+SELECT set_config('migration.allowlist_unlock', 'on', true);
+
+SELECT migration._allow(
+  'time_clock_entries', 'public.plg_workforce_time_entries', 'workforce',
+  'wf_time_entry', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',                  'id',
+    'unit_id',               'unit_id@companies:app.units',
+    -- O par polim\xF3rfico. Nenhuma das duas vira coluna: juntas elas viram
+    -- \`person_id\`, resolvido pelo ledger em migration._wf_person.
+    'person_type',           'jsonb:v1.person_type',
+    'person_id',             'jsonb:v1.person_id',
+    'person_name',           'person_name',
+    'checkin_at',            'checkin_at',
+    'checkout_at',           'checkout_at',
+    'checkin_photo_path',    'checkin_photo_path',
+    'checkin_lat',           'checkin_lat',
+    'checkin_lng',           'checkin_lng',
+    'checkin_accuracy_m',    'checkin_accuracy_m',
+    'checkin_ip',            'checkin_ip',
+    'checkin_user_agent',    'checkin_user_agent',
+    'checkin_face_score',    'checkin_face_score',
+    'checkout_photo_path',   'checkout_photo_path',
+    'checkout_lat',          'checkout_lat',
+    'checkout_lng',          'checkout_lng',
+    'checkout_accuracy_m',   'checkout_accuracy_m',
+    'checkout_ip',           'checkout_ip',
+    'checkout_user_agent',   'checkout_user_agent',
+    'checkout_face_score',   'checkout_face_score',
+    'schedule_assignment_id','assignment_id@schedule_assignments',
+    -- O ajuste do V1 n\xE3o vira coluna: vira LINHA em
+    -- plg_workforce_time_adjustments, com autor e motivo.
+    'checkin_adjusted_at',   'checkin_adjusted_at',
+    'checkout_adjusted_at',  'checkout_adjusted_at',
+    'adjustment_reason',     'adjustment_reason',
+    'adjusted_by_user_id',   'adjusted_by_user_id',
+    'adjusted_by_name',      'adjusted_by_name',
+    -- Derivadas e n\xE3o portadas: \`manually_adjusted\` \xE9 a exist\xEAncia de um ajuste,
+    -- \`adjusted_by\`/\`adjusted_at\` s\xE3o redundantes com a linha do ajuste, e
+    -- \`outside_schedule\` \xE9 o resultado do cruzamento \u2014 que no V1 \xE9 \`true\` em 325
+    -- de 325 registros por um defeito de configura\xE7\xE3o, e que no V2 \xE9 a coluna
+    -- \`outside_schedule\` da view v_workforce_day, calculada e n\xE3o guardada.
+    'manually_adjusted',     '-',
+    'adjusted_by',           '-',
+    'adjusted_at',           '-',
+    'outside_schedule',      'jsonb:v1.outside_schedule',
+    'notes',                 'notes',
+    -- N\xC3O vira FK: no V1 aponta para a tabela de t\xEDtulos do V1, cuja contraparte
+    -- no V2 n\xE3o \xE9 a mesma coisa (mesma recusa da 046). A refer\xEAncia crua \xE9 o que
+    -- TRAVA o ajuste da linha migrada \u2014 a trigger da se\xE7\xE3o 4 l\xEA exatamente aqui.
+    'payable_invoice_id',    'jsonb:v1.payable_invoice_id'
+  ),
+  'A batida. Uma linha do V1 (par entrada/sa\xEDda + colunas de ajuste) vira at\xE9 4 do V2: dois eventos append-only e duas linhas de ajuste. checkout_at nulo atravessa como aus\xEAncia de evento \u2014 \xE9 o ponto em aberto, 20 deles no tenant medido.'
+);
+
+SELECT migration._allow(
+  'schedule_templates', 'public.plg_workforce_schedule_templates', 'workforce',
+  'wf_schedule_template', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',    'id',
+    'unit_id', 'unit_id@companies:app.units',
+    'name',    'name',
+    'active',  'is_active'
+  ),
+  'O molde da escala. Pr\xE9-requisito duro: sem template o V1 n\xE3o deixa criar escala nenhuma.'
+);
+
+SELECT migration._allow(
+  'schedule_template_shifts', 'public.plg_workforce_schedule_shifts', 'workforce',
+  'wf_schedule_shift', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',        'id',
+    'template_id', 'template_id@schedule_templates',
+    'label',       'label',
+    'start_time',  'start_time',
+    'end_time',    'end_time',
+    'weekdays',    'weekdays',
+    'sort_order',  'sort_order'
+  ),
+  'O turno do molde. weekdays \xE9 0..6 (domingo..s\xE1bado); qualquer valor fora disso \xE9 quarentena, porque um turno que nunca acontece some sem erro.'
+);
+
+SELECT migration._allow(
+  'schedule_template_requirements', 'public.plg_workforce_schedule_requirements', 'workforce',
+  'wf_schedule_requirement', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',            'id',
+    'shift_id',        'shift_id@schedule_template_shifts',
+    'profession_name', 'profession_name',
+    'required_count',  'required_count'
+  ),
+  'A lota\xE7\xE3o da fun\xE7\xE3o no turno \u2014 o "(1/1)" da tela, e o denominador que transforma posi\xE7\xE3o em titular/stand-by.'
+);
+
+SELECT migration._allow(
+  'schedule_template_assignments', 'public.plg_workforce_schedule_template_assignments', 'workforce',
+  'wf_schedule_template_assignment', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',            'id',
+    'template_id',     'template_id@schedule_templates',
+    'shift_id',        'shift_id@schedule_template_shifts',
+    'profession_name', 'profession_name',
+    'professional_id', 'jsonb:v1.person_id',
+    'priority',        'priority'
+  ),
+  'A aloca\xE7\xE3o do molde. No V1 titular \xD7 stand-by \xE9 POSICIONAL (os primeiros required_count por priority) e vive s\xF3 no c\xF3digo da tela; o writer faz a conta uma vez e grava em \`role\`.'
+);
+
+SELECT migration._allow(
+  'schedules', 'public.plg_workforce_schedules', 'workforce',
+  'wf_schedule', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',              'id',
+    'unit_id',           'unit_id@companies:app.units',
+    'schedule_date',     'schedule_date',
+    'template_id',       'template_id@schedule_templates',
+    'status',            'status',
+    'published_at',      'published_at',
+    'is_special_day',    'is_special_day',
+    'special_day_label', 'special_day_label',
+    'notes',             'notes'
+  ),
+  'A escala do dia. Hom\xF4nima da \`public.schedules\` do V2, que \xE9 OUTRA coisa (a oferta de hor\xE1rio do spine) \u2014 \xE9 a raz\xE3o do prefixo plg_workforce_.'
+);
+
+SELECT migration._allow(
+  'schedule_assignments', 'public.plg_workforce_schedule_assignments', 'workforce',
+  'wf_schedule_assignment', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',             'id',
+    'schedule_id',      'schedule_id@schedules',
+    'shift_id',         'shift_id@schedule_template_shifts',
+    -- O SNAPSHOT do V1 atravessa como snapshot. Reconstru\xED-lo a partir do turno
+    -- atual do molde reescreveria a escala de anteontem quando o molde mudasse.
+    'shift_label',      'shift_label',
+    'shift_start_time', 'shift_start_time',
+    'shift_end_time',   'shift_end_time',
+    'profession_name',  'profession_name',
+    'professional_id',  'jsonb:v1.person_id',
+    'role',             'role',
+    'priority',         'priority',
+    'status',           'status',
+    'response_token',   'response_token',
+    'response_channel', 'response_channel',
+    'notified_at',      'notified_at',
+    'responded_at',     'responded_at'
+  ),
+  'A atribui\xE7\xE3o do dia. Stand-by n\xE3o \xE9 folga: \xE9 o substituto acion\xE1vel ("Substitutos em caso de falta"), e confundir os dois apagaria a fila de quem cobre a falta.'
+);
+
+SELECT migration._allow(
+  'schedule_assignment_logs', 'public.plg_workforce_assignment_logs', 'workforce',
+  'wf_assignment_log', '{}'::jsonb, ARRAY[]::text[],
+  jsonb_build_object(
+    'uuid',              'id',
+    'assignment_id',     'assignment_id@schedule_assignments',
+    'from_status',       'from_status',
+    'to_status',         'to_status',
+    'channel',           'channel',
+    'note',              'note',
+    'changed_by_user_id','changed_by_user_id',
+    'created_at',        'created_at'
+  ),
+  'O hist\xF3rico da atribui\xE7\xE3o: a \xFAnica parte do modelo de escala do V1 que j\xE1 nasceu append-only, e que atravessa como \xE9.'
+);
+
+-- As duas que N\xC3O atravessam, e a raz\xE3o escrita onde a pr\xF3xima onda vai
+-- procurar. "Grid" aqui \xE9 grade de disponibilidade de AGENDAMENTO \u2014 quando um
+-- hor\xE1rio pode ser marcado \u2014, n\xE3o escala de trabalho. Port\xE1-las para dentro do
+-- RH criaria a terceira tabela de hor\xE1rio do cluster e colocaria a agenda dentro
+-- do plugin que o D3 mandou justamente separar dela.
+-- \`WHERE tenant_id IS NULL\` no \xE1rbitro: a 073 da espinha trocou a PK de
+-- \`migration.excluded_tables\` por dois \xEDndices \xFAnicos PARCIAIS \u2014 um global e
+-- um por inquilino \u2014, porque "n\xE3o trazer esta tabela" passou a ser decis\xE3o de
+-- cliente e n\xE3o do cluster. \xCDndice parcial s\xF3 serve de \xE1rbitro de ON CONFLICT
+-- quando o comando repete o mesmo recorte. Esta decis\xE3o \xE9 global.
+INSERT INTO migration.excluded_tables (source_table, reason) VALUES
+  ('schedule_grids',
+   'Apesar do nome, \xE9 grade de disponibilidade de AGENDAMENTO (quando um hor\xE1rio pode ser marcado), n\xE3o escala de trabalho. O destino natural \xE9 a agenda (public.schedules, kind working_hours), n\xE3o o RH.'),
+  ('schedule_grid_blocks',
+   'Bloco da grade de agendamento \u2014 mesma raz\xE3o de schedule_grids. Escala de trabalho \xE9 plg_workforce_schedule_*.')
+ON CONFLICT (source_table) WHERE tenant_id IS NULL DO UPDATE SET reason = EXCLUDED.reason;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 10. A amarra\xE7\xE3o com o financeiro, quando o financeiro existe
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Hora de trabalho vira dinheiro, e o V2 j\xE1 tem onde: \`plg_financial_invoices\`
+-- para o t\xEDtulo, \`plg_financial_chart_of_accounts\` e \`plg_financial_cost_centers\`
+-- para a classifica\xE7\xE3o. O que a jornada N\xC3O pode fazer \xE9 exigir o financeiro:
+-- o plugin \xE9 instal\xE1vel sozinho, e uma FK inline recusaria o arquivo inteiro num
+-- cluster que n\xE3o ligou o m\xF3dulo. Declarar a FK aqui, condicionada ao destino,
+-- \xE9 o que d\xE1 integridade onde ela \xE9 poss\xEDvel sem transformar prefer\xEAncia em
+-- depend\xEAncia.
+--
+-- Todas ON DELETE SET NULL: apagar um centro de custo n\xE3o pode apagar a batida
+-- de ningu\xE9m. O v\xEDnculo some, a hora fica.
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT * FROM (VALUES
+      ('plg_workforce_time_entries', 'chart_account_id',   'plg_financial_chart_of_accounts'),
+      ('plg_workforce_time_entries', 'cost_center_id',     'plg_financial_cost_centers'),
+      ('plg_workforce_time_entries', 'payable_invoice_id', 'plg_financial_invoices'),
+      ('plg_workforce_schedule_shifts', 'chart_account_id', 'plg_financial_chart_of_accounts'),
+      ('plg_workforce_schedule_shifts', 'cost_center_id',   'plg_financial_cost_centers'),
+      ('plg_workforce_periods', 'chart_account_id',   'plg_financial_chart_of_accounts'),
+      ('plg_workforce_periods', 'cost_center_id',     'plg_financial_cost_centers'),
+      ('plg_workforce_periods', 'payable_invoice_id', 'plg_financial_invoices')
+    ) AS t(tbl, col, target)
+  LOOP
+    CONTINUE WHEN to_regclass('public.' || r.target) IS NULL;
+    CONTINUE WHEN EXISTS (SELECT 1 FROM pg_constraint
+                           WHERE conname = r.tbl || '_' || r.col || '_fkey'
+                             AND conrelid = ('public.' || r.tbl)::regclass);
+    EXECUTE format(
+      'ALTER TABLE public.%I ADD CONSTRAINT %I FOREIGN KEY (%I) REFERENCES public.%I(id) ON DELETE SET NULL',
+      r.tbl, r.tbl || '_' || r.col || '_fkey', r.col, r.target);
+  END LOOP;
+END $$;
+
+SELECT set_config('migration.allowlist_unlock', 'off', true);
+`;
+var MIGRATION_001_A_PROVA_DA_BATIDA_TEM_BYTES = `-- ---------------------------------------------------------------------------
+-- 001_a_prova_da_batida_tem_bytes.sql \u2014 a foto do ponto atravessa, e n\xE3o s\xF3 o
+-- caminho dela.
+--
+-- A 000 escreveu, no coment\xE1rio de \`evidence\`:
+--
+--     "O que n\xE3o pode \xE9 perder: no V1 s\xE3o \`photo_path\`, \`lat\`, \`lng\`,
+--      \`accuracy_m\`, \`ip\`, \`user_agent\` e \`face_score\`."
+--
+-- Sete campos. Seis atravessaram. O s\xE9timo \u2014 o \xFAnico que uma pessoa reconhece \u2014
+-- atravessou como TEXTO: \`8/2026-07-05/professional-15-1783278419303.jpg\`,
+-- que \xE9 um objeto num bucket PRIVADO de outro projeto Supabase, o do V1.
+--
+-- Medido em 18/09/2026 no tenant Pertinho do C\xE9u: 1.320 das 1.361 batidas t\xEAm
+-- esse caminho preenchido, e nenhuma das 1.320 imagens \xE9 alcan\xE7\xE1vel daqui. No
+-- dia em que o V1 sair do ar elas deixam de existir em qualquer lugar.
+--
+-- \xC9 pior que uma coluna vazia, porque parece cheia. \`evidence.photo_path\` diz
+-- que houve captura e sugere que a captura est\xE1 guardada. A tela de Registros de
+-- Ponto, por isso mesmo, escondia a se\xE7\xE3o de evid\xEAncia inteira \u2014 o coment\xE1rio
+-- dela dizia que a evid\xEAncia estava "hoje vazia", o que j\xE1 n\xE3o era verdade.
+--
+-- Este arquivo declara para o motor de arquivos da 054 (\`migration.asset_kinds\`)
+-- que a foto de batida \xE9 uma esp\xE9cie com bytes para transportar: de que bucket
+-- ela sai, para qual vai, o que falta atravessar, e quem reescreve o ponteiro.
+-- Mover os bytes \xE9 do fayz-etl (\`fayz_etl/blobs.py\`); a regra \xE9 daqui.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- \xA71  O bucket, PRIVADO
+--
+-- N\xE3o \xE9 escolha de estilo: \xE9 biometria facial de um funcion\xE1rio, com hora e
+-- coordenada ao lado. O V1 j\xE1 a guarda em bucket privado e serve por URL
+-- assinada de curta dura\xE7\xE3o (edge function \`time-clock-photo-url\`), e o V2 n\xE3o
+-- pode rebaixar isso \u2014 um bucket p\xFAblico transformaria "a cara e o hor\xE1rio de
+-- quem trabalha aqui" em algo que basta um caminho para ver.
+--
+-- A leitura \xE9 por pasta de tenant, o mesmo escopo que o resto da plataforma usa.
+-- Com ele, \`createSignedUrl\` do lado do app funciona para quem \xE9 do tenant e
+-- falha para quem n\xE3o \xE9, sem RPC no meio.
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+VALUES ('workforce-punch-photos', 'workforce-punch-photos', false, 5242880,
+        ARRAY['image/jpeg', 'image/png', 'image/webp'])
+ON CONFLICT (id) DO UPDATE SET
+  public             = EXCLUDED.public,
+  file_size_limit    = EXCLUDED.file_size_limit,
+  allowed_mime_types = EXCLUDED.allowed_mime_types;
+
+DROP POLICY IF EXISTS plg_workforce_punch_photos_read   ON storage.objects;
+DROP POLICY IF EXISTS plg_workforce_punch_photos_insert ON storage.objects;
+DROP POLICY IF EXISTS plg_workforce_punch_photos_update ON storage.objects;
+DROP POLICY IF EXISTS plg_workforce_punch_photos_delete ON storage.objects;
+
+-- Sem \`anon\`. A prova de uma jornada n\xE3o se l\xEA deslogado.
+CREATE POLICY plg_workforce_punch_photos_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (
+    bucket_id = 'workforce-punch-photos'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
+  );
+
+CREATE POLICY plg_workforce_punch_photos_insert ON storage.objects
+  FOR INSERT TO authenticated
+  WITH CHECK (
+    bucket_id = 'workforce-punch-photos'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
+  );
+
+CREATE POLICY plg_workforce_punch_photos_update ON storage.objects
+  FOR UPDATE TO authenticated
+  USING (
+    bucket_id = 'workforce-punch-photos'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
+  )
+  WITH CHECK (
+    bucket_id = 'workforce-punch-photos'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text)
+  );
+
+-- DELETE fica de fora de prop\xF3sito: apagar a foto de uma batida \xE9 apagar prova.
+-- Quem precisar (pedido de exclus\xE3o LGPD) passa pelo \`service_role\`, que \xE9 um
+-- ato deliberado e registrado, n\xE3o um clique.
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- \xA72  A esp\xE9cie
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+SELECT public.register_kind('document', 'punch_photo', 'workforce', ARRAY['active'], NULL,
+  'A foto que o totem capturou na batida \u2014 prova de quem bateu o ponto, junto com GPS e score facial');
+
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- \xA73  O que falta, e o ponteiro
+--
+-- Todo o resto deste arquivo depende da 054 do base. Num pool que ainda n\xE3o a
+-- aplicou, o plugin instala sem o transporte de bytes em vez de recusar a
+-- instala\xE7\xE3o: o ponto funciona sem foto, e a foto sem o ponto n\xE3o \xE9 nada.
+-- \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+DO $do$
+BEGIN
+IF to_regproc('migration.register_asset_kind(text,text,text,text,text,text)') IS NULL THEN
+  RAISE NOTICE 'plugin-workforce 001: migration.register_asset_kind ausente (base < 054); a foto da batida fica sem transporte';
+  RETURN;
+END IF;
+
+CREATE OR REPLACE VIEW migration.v_asset_backlog_punch_photo AS
+SELECT e.tenant_id,
+       'time_entry'::text        AS subject_type,
+       e.id                      AS subject_id,
+       e.person_id,
+       e.evidence ->> 'photo_path' AS source_path,
+       -- O bucket do V1 \xE9 privado: n\xE3o h\xE1 URL para baixar sem chave, e o
+       -- transporte usa a chave de servi\xE7o da origem.
+       NULL::text                AS source_url,
+       -- Uma foto por batida, nomeada pela batida. O caminho do V1 tem epoch no
+       -- nome e n\xE3o \xE9 reconstru\xEDvel a partir do destino; o do V2 \xE9 deriv\xE1vel de
+       -- qualquer lado, o que \xE9 o que faz o rerun sobrescrever em vez de dobrar.
+       e.tenant_id::text || '/' || e.id::text || '.jpg' AS target_path,
+       coalesce(e.person_name, 'sem nome') || ' \xB7 '
+         || to_char(e.punched_at, 'DD/MM/YYYY HH24:MI') AS title
+  FROM public.plg_workforce_time_entries e
+ -- \`photo_path\` \xE9 a proced\xEAncia (o caminho no V1, que fica); \`photo\` \xE9 o
+ -- ponteiro do V2. Ter o primeiro e n\xE3o o segundo \xC9 a defini\xE7\xE3o de "falta
+ -- atravessar", e escrever o segundo tira a linha desta lista.
+ WHERE e.evidence ? 'photo_path'
+   AND NOT (e.evidence ? 'photo');
+
+COMMENT ON VIEW migration.v_asset_backlog_punch_photo IS
+  'Batidas cuja foto ainda s\xF3 existe no bucket privado do V1 (001). A condi\xE7\xE3o \xC9 o ponteiro: escrever evidence.photo apaga a linha desta lista.';
+
+CREATE OR REPLACE FUNCTION migration._point_punch_photo(p_tenant uuid, p_document uuid, p_row jsonb)
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+DECLARE v_entry uuid := (p_row ->> 'subject_id')::uuid;
+BEGIN
+  IF v_entry IS NULL THEN
+    RAISE EXCEPTION '_point_punch_photo: preciso de subject_id (a batida)' USING ERRCODE = '22023';
+  END IF;
+  -- UPDATE numa tabela append-only: passa porque \`attach_asset\` liga
+  -- \`migration.writer\`, que \xE9 a mesma escotilha que o writer da batida usa.
+  -- \`photo_path\` N\xC3O \xE9 tocado \u2014 ele \xE9 de onde a imagem veio, e continua sendo.
+  UPDATE public.plg_workforce_time_entries
+     SET evidence = migration._deep_set(coalesce(evidence, '{}'::jsonb), ARRAY['photo'],
+                      jsonb_build_object(
+                        'bucket',      p_row ->> 'bucket',
+                        'path',        p_row ->> 'target_path',
+                        'document_id', p_document)),
+         updated_at = now()
+   WHERE id = v_entry AND tenant_id = p_tenant;
+END $fn$;
+
+PERFORM migration.register_asset_kind(
+  'punch_photo', 'time-clock-photos', 'workforce-punch-photos',
+  'v_asset_backlog_punch_photo', 'migration._point_punch_photo',
+  'A foto do totem. Bucket privado nas duas pontas: \xE9 biometria facial com hora e coordenada ao lado, e o V1 j\xE1 a tratava assim.');
+END $do$;
+`;
+var MIGRATION_002_O_GUARDA_DA_FOTO_OLHAVA_O_NOME_ERRADO = `-- ---------------------------------------------------------------------------
+-- 002_o_guarda_da_foto_olhava_o_nome_errado.sql \u2014 o \xA73 da 001 nunca rodou.
+--
+-- A 001 protege o pr\xF3prio corpo com um guard, porque tudo nela depois do \xA72
+-- depende da 054 do base:
+--
+--     IF to_regproc('migration.register_asset_kind(text,text,text,text,text,text)')
+--        IS NULL THEN RETURN; END IF;
+--
+-- **\`to_regproc\` recebe um NOME, n\xE3o uma assinatura.** Com a lista de tipos
+-- entre par\xEAnteses ela devolve NULL \u2014 e n\xE3o levanta erro, que \xE9 exatamente o que
+-- torna isso invis\xEDvel: \`to_regproc\` foi feita para responder "n\xE3o existe" em vez
+-- de estourar. Quem l\xEA a linha l\xEA uma checagem; o Postgres l\xEA uma pergunta
+-- malformada e responde "n\xE3o existe" \xE0s duas.
+--
+-- Resultado medido no cluster em 19/09/2026, logo depois de aplicar a 001: o
+-- bucket \`workforce-punch-photos\` existe (\xA71, fora do bloco), a esp\xE9cie
+-- \`punch_photo\` est\xE1 registrada (\xA72, fora do bloco), e do \xA73 n\xE3o existe NADA \u2014
+-- nem a view de backlog, nem \`_point_punch_photo\`, nem a linha em
+-- \`migration.asset_kinds\`. A migration "passou". A foto continuou sem
+-- transporte, e o \`mig-assets\` teria relatado s\xF3 os 63 avatares como se fosse o
+-- backlog inteiro.
+--
+-- Quem quer assinatura \xE9 \`to_regprocedure\`. \xC9 a \xFAnica diferen\xE7a deste arquivo.
+--
+-- \u2500\u2500 Por que um arquivo novo, e n\xE3o uma corre\xE7\xE3o na 001 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A 001 j\xE1 est\xE1 no ledger deste cluster. \`fayz db apply\` trata checksum
+-- diferente num arquivo aplicado como PARADA \u2014 e est\xE1 certo: um app que j\xE1 rodou
+-- a 001 n\xE3o pode descobrir que os bytes dela mudaram. Corrigir para frente custa
+-- este arquivo; editar a 001 custaria o apply de todo app que j\xE1 a tomou.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+DO $do$
+BEGIN
+-- \`to_regprocedure\`, que \xE9 quem entende \`(text,text,\u2026)\`. A mesma armadilha est\xE1
+-- na 152 do base (\`to_regproc('app.scaffold_table(text,text,text,boolean,text)')\`),
+-- e \xE9 por isso que a checagem aqui \xE9 pelo NOME quando basta o nome: um guard que
+-- mente \xE9 pior que nenhum guard, porque o arquivo sai dizendo que aplicou.
+IF to_regprocedure('migration.register_asset_kind(text,text,text,text,text,text)') IS NULL THEN
+  RAISE NOTICE 'plugin-workforce 002: migration.register_asset_kind ausente (base < 054); a foto da batida fica sem transporte';
+  RETURN;
+END IF;
+
+CREATE OR REPLACE VIEW migration.v_asset_backlog_punch_photo AS
+SELECT e.tenant_id,
+       'time_entry'::text        AS subject_type,
+       e.id                      AS subject_id,
+       e.person_id,
+       e.evidence ->> 'photo_path' AS source_path,
+       -- O bucket do V1 \xE9 privado: n\xE3o h\xE1 URL para baixar sem chave, e o
+       -- transporte usa a chave de servi\xE7o da origem.
+       NULL::text                AS source_url,
+       -- Uma foto por batida, nomeada pela batida. O caminho do V1 tem epoch no
+       -- nome e n\xE3o \xE9 reconstru\xEDvel a partir do destino; o do V2 \xE9 deriv\xE1vel de
+       -- qualquer lado, o que \xE9 o que faz o rerun sobrescrever em vez de dobrar.
+       e.tenant_id::text || '/' || e.id::text || '.jpg' AS target_path,
+       coalesce(e.person_name, 'sem nome') || ' \xB7 '
+         || to_char(e.punched_at, 'DD/MM/YYYY HH24:MI') AS title
+  FROM public.plg_workforce_time_entries e
+ -- \`photo_path\` \xE9 a proced\xEAncia (o caminho no V1, que fica); \`photo\` \xE9 o
+ -- ponteiro do V2. Ter o primeiro e n\xE3o o segundo \xC9 a defini\xE7\xE3o de "falta
+ -- atravessar", e escrever o segundo tira a linha desta lista.
+ WHERE e.evidence ? 'photo_path'
+   AND NOT (e.evidence ? 'photo');
+
+COMMENT ON VIEW migration.v_asset_backlog_punch_photo IS
+  'Batidas cuja foto ainda s\xF3 existe no bucket privado do V1 (001/002). A condi\xE7\xE3o \xC9 o ponteiro: escrever evidence.photo apaga a linha desta lista.';
+
+CREATE OR REPLACE FUNCTION migration._point_punch_photo(p_tenant uuid, p_document uuid, p_row jsonb)
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $fn$
+DECLARE v_entry uuid := (p_row ->> 'subject_id')::uuid;
+BEGIN
+  IF v_entry IS NULL THEN
+    RAISE EXCEPTION '_point_punch_photo: preciso de subject_id (a batida)' USING ERRCODE = '22023';
+  END IF;
+  -- UPDATE numa tabela append-only: passa porque \`attach_asset\` liga
+  -- \`migration.writer\`, que \xE9 a mesma escotilha que o writer da batida usa.
+  -- \`photo_path\` N\xC3O \xE9 tocado \u2014 ele \xE9 de onde a imagem veio, e continua sendo.
+  UPDATE public.plg_workforce_time_entries
+     SET evidence = migration._deep_set(coalesce(evidence, '{}'::jsonb), ARRAY['photo'],
+                      jsonb_build_object(
+                        'bucket',      p_row ->> 'bucket',
+                        'path',        p_row ->> 'target_path',
+                        'document_id', p_document)),
+         updated_at = now()
+   WHERE id = v_entry AND tenant_id = p_tenant;
+END $fn$;
+
+PERFORM migration.register_asset_kind(
+  'punch_photo', 'time-clock-photos', 'workforce-punch-photos',
+  'v_asset_backlog_punch_photo', 'migration._point_punch_photo',
+  'A foto do totem. Bucket privado nas duas pontas: \xE9 biometria facial com hora e coordenada ao lado, e o V1 j\xE1 a tratava assim.');
+END $do$;
+`;
+var MIGRATION_003_O_PONTO_EM_ABERTO_PARA_DE_MENTIR_A_DURACAO = `-- ---------------------------------------------------------------------------
+-- 003_o_ponto_em_aberto_para_de_mentir_a_duracao.sql \u2014 \`-497155h02\`.
+--
+-- A tela de Registros de Ponto mostra isso na coluna Dura\xE7\xE3o de todo ponto em
+-- aberto. Medido em 19/09/2026 no tenant Pertinho do C\xE9u: **19 dias negativos,
+-- e os 19 est\xE3o abertos** \u2014 nenhum dia fechado d\xE1 negativo. O n\xFAmero n\xE3o \xE9
+-- aleat\xF3rio e n\xE3o \xE9 overflow.
+--
+-- \u2500\u2500 De onde ele sai \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A 000 soma as horas com sinal, e o desenho \xE9 bom: \`clock_out\` e \`break_start\`
+-- FECHAM um trecho e entram positivos, \`clock_in\` e \`break_end\` ABREM e entram
+-- negativos. Quantos intervalos o dia tiver, a conta \xE9 a mesma \u2014 \xE9 isso que o
+-- par \xFAnico do V1 n\xE3o consegue fazer.
+--
+-- Ela s\xF3 assume uma coisa que o dia em aberto n\xE3o cumpre: que toda abertura tem
+-- o seu fechamento. Um dia com uma batida s\xF3 \u2014
+--
+--     clock_in 18:09
+--
+-- \u2014 soma \`-extract(epoch FROM '2026-09-18 18:09')\`, que \xE9 \u22121.789.790.  \u2060 segundos
+-- desde 1970. Dividido por 60 vira \u221229.829.302 minutos, e o formatador de horas
+-- faz o resto: \`-497155h02\`. O epoch vazou para a tela.
+--
+-- \u2500\u2500 O conserto da conta \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Devolver \xE0 soma a abertura que ficou sem par. O que sobra \xE9 exatamente a
+-- soma dos trechos FECHADOS, que \xE9 a \xFAnica coisa que se pode afirmar de um dia
+-- que ainda n\xE3o terminou:
+--
+--     entrada 09:00, sa\xEDda 12:00, entrada 13:00   \u2192  3h00 fechadas, aberto desde 13:00
+--     entrada 18:09                               \u2192  0h00 fechadas, aberto desde 18:09
+--
+-- Zero n\xE3o \xE9 um defeito aqui: \xE9 a resposta certa para "quanto j\xE1 fechou?" antes
+-- de qualquer fechamento. O que faltava para a tela era a OUTRA metade da
+-- pergunta, e \xE9 a coluna nova.
+--
+-- \u2500\u2500 \`open_since\`, e por que uma coluna e n\xE3o uma conta na tela \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Quem confere ponto quer saber h\xE1 quanto tempo a pessoa est\xE1 dentro. A tela
+-- n\xE3o consegue descobrir isso sozinha: ela recebe o dia agregado, n\xE3o as
+-- batidas, e "a \xFAltima abertura sem par" \xE9 justamente o que a agrega\xE7\xE3o sabe e
+-- ela n\xE3o. Sem a coluna, a alternativa seria a tela buscar as batidas de cada
+-- linha \u2014 299 consultas para desenhar uma tabela.
+--
+-- O rel\xF3gio corre do lado de quem olha, n\xE3o do banco: a coluna \xE9 o INSTANTE, e
+-- o "6h58 em curso" \xE9 calculado no render. Um intervalo calculado aqui
+-- envelheceria entre a consulta e a pintura, e envelheceria de novo a cada
+-- segundo que a aba ficasse aberta.
+--
+-- \u2500\u2500 O que N\xC3O muda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Dia em aberto continua **fora** do total do dia e do per\xEDodo. A regra \xE9 a do
+-- V1 e est\xE1 certa: contar uma jornada que n\xE3o terminou inventa hora que ningu\xE9m
+-- trabalhou. O que muda \xE9 que agora o n\xFAmero que ele n\xE3o soma tamb\xE9m n\xE3o \xE9
+-- absurdo quando algu\xE9m olha a linha.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE VIEW public.v_workforce_day
+WITH (security_invoker = 'true') AS
+WITH bruto AS (
+  SELECT e.tenant_id,
+         e.unit_id,
+         e.person_id,
+         e.work_date,
+         min(e.effective_at) FILTER (WHERE e.kind = 'clock_in')  AS first_in,
+         max(e.effective_at) FILTER (WHERE e.kind = 'clock_out') AS last_out,
+         count(*) FILTER (WHERE e.kind = 'break_start')          AS break_count,
+         count(*) FILTER (WHERE e.kind IN ('clock_in', 'break_end'))    AS aberturas,
+         count(*) FILTER (WHERE e.kind IN ('clock_out', 'break_start')) AS fechamentos,
+         -- A \xFAltima ABERTURA do dia. Quando as contagens n\xE3o batem, \xE9 ela que
+         -- ficou sem par \u2014 os eventos de um dia chegam em ordem, e uma abertura
+         -- anterior j\xE1 teria sido fechada pela seguinte.
+         max(e.effective_at) FILTER (WHERE e.kind IN ('clock_in', 'break_end')) AS ultima_abertura,
+         sum(CASE
+               WHEN e.kind IN ('clock_out', 'break_start') THEN  extract(epoch FROM e.effective_at)
+               WHEN e.kind IN ('clock_in',  'break_end')   THEN -extract(epoch FROM e.effective_at)
+             END) AS soma_com_sinal
+    FROM public.v_workforce_time_entries e
+   WHERE NOT e.voided
+   GROUP BY e.tenant_id, e.unit_id, e.person_id, e.work_date
+),
+realized AS (
+  SELECT b.tenant_id,
+         b.unit_id,
+         b.person_id,
+         b.work_date,
+         b.first_in,
+         b.last_out,
+         b.break_count,
+         (b.aberturas <> b.fechamentos) AS is_open,
+         CASE WHEN b.aberturas <> b.fechamentos THEN b.ultima_abertura END AS open_since,
+         -- Devolve \xE0 soma a abertura sem par. Sem isto o que sobra \xE9 o epoch
+         -- dela, com sinal trocado, e foi o que a tela vinha mostrando.
+         (b.soma_com_sinal
+            + CASE WHEN b.aberturas <> b.fechamentos
+                   THEN extract(epoch FROM b.ultima_abertura)
+                   ELSE 0 END) AS worked_seconds
+    FROM bruto b
+),
+planned AS (
+  SELECT a.tenant_id,
+         a.unit_id,
+         a.person_id,
+         s.schedule_date AS work_date,
+         a.id            AS assignment_id,
+         a.role,
+         a.status        AS assignment_status,
+         a.shift_label,
+         a.shift_start_time,
+         a.shift_end_time,
+         -- O turno que vira o dia \xE9 normal aqui; sem o +24h a jornada da noite
+         -- daria negativa.
+         (extract(epoch FROM a.shift_end_time - a.shift_start_time)
+            + CASE WHEN a.shift_end_time <= a.shift_start_time THEN 86400 ELSE 0 END) AS planned_seconds
+    FROM public.plg_workforce_schedule_assignments a
+    JOIN public.plg_workforce_schedules s ON s.id = a.schedule_id
+   WHERE s.status IN ('published', 'closed')
+     AND a.role = 'titular'
+     AND a.shift_start_time IS NOT NULL
+     AND a.shift_end_time IS NOT NULL
+)
+SELECT coalesce(p.tenant_id, r.tenant_id) AS tenant_id,
+       coalesce(p.unit_id,   r.unit_id)   AS unit_id,
+       coalesce(p.person_id, r.person_id) AS person_id,
+       coalesce(p.work_date, r.work_date) AS work_date,
+       p.assignment_id,
+       p.shift_label,
+       p.shift_start_time,
+       p.shift_end_time,
+       p.assignment_status,
+       (p.planned_seconds / 60)::integer                       AS planned_minutes,
+       (r.worked_seconds  / 60)::integer                       AS worked_minutes,
+       ((r.worked_seconds - p.planned_seconds) / 60)::integer  AS variance_minutes,
+       r.first_in,
+       r.last_out,
+       r.break_count,
+       coalesce(r.is_open, false)                              AS is_open,
+       (r.person_id IS NULL)                                   AS absent,
+       (p.assignment_id IS NULL)                               AS outside_schedule,
+       -- Coluna nova, no fim: \`CREATE OR REPLACE VIEW\` s\xF3 aceita acrescentar
+       -- aqui, e \xE9 de prop\xF3sito \u2014 quem l\xEA por posi\xE7\xE3o n\xE3o se move.
+       r.open_since
+  FROM planned p
+  FULL OUTER JOIN realized r
+    ON r.tenant_id = p.tenant_id
+   AND r.person_id = p.person_id
+   AND r.work_date = p.work_date;
+
+COMMENT ON VIEW public.v_workforce_day IS
+  'Jornada prevista \xD7 realizada por pessoa e dia. Previsto vem da escala publicada, realizado das batidas com ajuste aplicado. FULL OUTER JOIN: \`absent\` \xE9 escala sem ponto, \`outside_schedule\` \xE9 ponto sem escala. \`worked_minutes\` conta s\xF3 os trechos FECHADOS; \`open_since\` \xE9 a abertura que ainda n\xE3o tem par (003).';
+
+COMMENT ON COLUMN public.v_workforce_day.open_since IS
+  'O instante da abertura sem par, quando o ponto est\xE1 aberto (003). \xC9 o INSTANTE e n\xE3o a dura\xE7\xE3o: o rel\xF3gio corre do lado de quem olha a tela, e um intervalo calculado aqui envelheceria entre a consulta e a pintura.';
+
+GRANT SELECT ON public.v_workforce_day TO authenticated, service_role;
+`;
+var MIGRATION_004_A_JORNADA_IMPLAUSIVEL_NAO_SOMA = `-- ---------------------------------------------------------------------------
+-- 004_a_jornada_implausivel_nao_soma.sql \u2014 45h45 num dia.
+--
+-- Medido em 19/09/2026 no tenant Pertinho do C\xE9u, na tela de Registros de Ponto:
+--
+--     Steffany Fidelis da Costa   15:41 \u2192 13:26   45h45
+--     CRISTIANE CARDOSO OLIVEIRA  17:14 \u2192 09:23   16h10
+--     jannyne gomes dos santos    09:07 \u2192 08:58   15h56
+--
+-- e o cabe\xE7alho do dia somando **109h45** para oito pessoas.
+--
+-- Nenhum desses \xE9 erro de conta: a 003 j\xE1 consertou a soma, e esses dias est\xE3o
+-- FECHADOS. Eles s\xE3o a medi\xE7\xE3o correta de um par errado \u2014 algu\xE9m entrou, foi
+-- embora sem bater a sa\xEDda, e a sa\xEDda caiu horas ou dias depois. O V1 grava
+-- \`checkin_at\` e \`checkout_at\` como um par s\xF3, ent\xE3o o buraco atravessou inteiro.
+--
+-- \u2500\u2500 Por que n\xE3o um teto de 8h \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Trocar 45h45 por 8h faria o total parecer certo. \xC9 o pior resultado poss\xEDvel:
+--
+--   \xB7 8h ali \xE9 um n\xFAmero que ningu\xE9m trabalhou e ningu\xE9m digitou \u2014 \xE9 a regra
+--     "nada de default inventado" quebrada no lugar onde ela mais custa, que \xE9
+--     base de c\xE1lculo de folha;
+--   \xB7 e o dia deixaria de parecer estranho, ent\xE3o a batida furada nunca seria
+--     corrigida. O erro sai da tela e fica no dado, que \xE9 o contr\xE1rio de
+--     resolver.
+--
+-- \u2500\u2500 O que esta migration faz \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Estende a regra que a tela J\xC1 tem. Ponto em aberto n\xE3o soma, porque contar
+-- uma jornada que n\xE3o terminou inventa hora. Um dia de 45h \xE9 o mesmo problema
+-- com outra cara \u2014 um par em que n\xE3o se pode confiar \u2014, ent\xE3o ele tamb\xE9m n\xE3o
+-- soma. O valor medido continua \xE0 vista, inteiro, com o motivo escrito ao lado.
+--
+-- \`review_reason\` nomeia por que o dia n\xE3o entra na conta:
+--
+--     'open'            ainda n\xE3o terminou
+--     'span_too_long'   fechou, e fechou com dura\xE7\xE3o que n\xE3o \xE9 uma jornada
+--
+-- NULL \xE9 o dia que conta. Uma coluna s\xF3, e quem soma filtra por ela \u2014 em vez de
+-- cada relat\xF3rio redescobrir a regra e descobrir diferente.
+--
+-- \u2500\u2500 O limite, e por que dezesseis horas \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A jornada mais longa do vocabul\xE1rio do V1 \xE9 a escala 12x36: doze horas. Com
+-- duas de extra, quatorze. Dezesseis deixa margem para o turno que vira a noite
+-- e ainda separa com folga o caso real, que n\xE3o \xE9 uma jornada comprida e sim
+-- uma sa\xEDda que ficou pendurada \u2014 os tr\xEAs medidos acima t\xEAm 16h, 16h e 46h.
+--
+-- \xC9 o MESMO dezesseis que a tela usa para dizer "sem sa\xEDda h\xE1 31h" num ponto
+-- aberto, e \xE9 de prop\xF3sito: um n\xFAmero, uma justificativa, os dois lados da
+-- mesma pergunta.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE FUNCTION public.workforce_max_shift_minutes()
+RETURNS integer LANGUAGE sql IMMUTABLE PARALLEL SAFE
+AS $$ SELECT 16 * 60 $$;
+
+COMMENT ON FUNCTION public.workforce_max_shift_minutes() IS
+  'Acima disto uma jornada fechada deixa de ser jornada e vira sa\xEDda n\xE3o batida (004). 12x36 \xE9 a mais longa do vocabul\xE1rio do V1; dezesseis d\xE1 margem ao turno que vira a noite. Fun\xE7\xE3o e n\xE3o constante literal para que a tela, a view e um relat\xF3rio futuro citem o mesmo n\xFAmero.';
+
+CREATE OR REPLACE VIEW public.v_workforce_day
+WITH (security_invoker = 'true') AS
+WITH bruto AS (
+  SELECT e.tenant_id,
+         e.unit_id,
+         e.person_id,
+         e.work_date,
+         min(e.effective_at) FILTER (WHERE e.kind = 'clock_in')  AS first_in,
+         max(e.effective_at) FILTER (WHERE e.kind = 'clock_out') AS last_out,
+         count(*) FILTER (WHERE e.kind = 'break_start')          AS break_count,
+         count(*) FILTER (WHERE e.kind IN ('clock_in', 'break_end'))    AS aberturas,
+         count(*) FILTER (WHERE e.kind IN ('clock_out', 'break_start')) AS fechamentos,
+         -- A \xFAltima ABERTURA do dia. Quando as contagens n\xE3o batem, \xE9 ela que
+         -- ficou sem par \u2014 os eventos de um dia chegam em ordem, e uma abertura
+         -- anterior j\xE1 teria sido fechada pela seguinte.
+         max(e.effective_at) FILTER (WHERE e.kind IN ('clock_in', 'break_end')) AS ultima_abertura,
+         sum(CASE
+               WHEN e.kind IN ('clock_out', 'break_start') THEN  extract(epoch FROM e.effective_at)
+               WHEN e.kind IN ('clock_in',  'break_end')   THEN -extract(epoch FROM e.effective_at)
+             END) AS soma_com_sinal
+    FROM public.v_workforce_time_entries e
+   WHERE NOT e.voided
+   GROUP BY e.tenant_id, e.unit_id, e.person_id, e.work_date
+),
+realized AS (
+  SELECT b.tenant_id,
+         b.unit_id,
+         b.person_id,
+         b.work_date,
+         b.first_in,
+         b.last_out,
+         b.break_count,
+         (b.aberturas <> b.fechamentos) AS is_open,
+         CASE WHEN b.aberturas <> b.fechamentos THEN b.ultima_abertura END AS open_since,
+         -- Devolve \xE0 soma a abertura sem par (003). Sem isto o que sobra \xE9 o
+         -- epoch dela, com sinal trocado.
+         (b.soma_com_sinal
+            + CASE WHEN b.aberturas <> b.fechamentos
+                   THEN extract(epoch FROM b.ultima_abertura)
+                   ELSE 0 END) AS worked_seconds
+    FROM bruto b
+),
+planned AS (
+  SELECT a.tenant_id,
+         a.unit_id,
+         a.person_id,
+         s.schedule_date AS work_date,
+         a.id            AS assignment_id,
+         a.role,
+         a.status        AS assignment_status,
+         a.shift_label,
+         a.shift_start_time,
+         a.shift_end_time,
+         -- O turno que vira o dia \xE9 normal aqui; sem o +24h a jornada da noite
+         -- daria negativa.
+         (extract(epoch FROM a.shift_end_time - a.shift_start_time)
+            + CASE WHEN a.shift_end_time <= a.shift_start_time THEN 86400 ELSE 0 END) AS planned_seconds
+    FROM public.plg_workforce_schedule_assignments a
+    JOIN public.plg_workforce_schedules s ON s.id = a.schedule_id
+   WHERE s.status IN ('published', 'closed')
+     AND a.role = 'titular'
+     AND a.shift_start_time IS NOT NULL
+     AND a.shift_end_time IS NOT NULL
+)
+SELECT coalesce(p.tenant_id, r.tenant_id) AS tenant_id,
+       coalesce(p.unit_id,   r.unit_id)   AS unit_id,
+       coalesce(p.person_id, r.person_id) AS person_id,
+       coalesce(p.work_date, r.work_date) AS work_date,
+       p.assignment_id,
+       p.shift_label,
+       p.shift_start_time,
+       p.shift_end_time,
+       p.assignment_status,
+       (p.planned_seconds / 60)::integer                       AS planned_minutes,
+       -- O MEDIDO, sempre. N\xE3o \xE9 aqui que se decide se ele conta \u2014 a coluna
+       -- mente se for corrigida, e um n\xFAmero corrigido em sil\xEAncio \xE9 pior que
+       -- um n\xFAmero estranho.
+       (r.worked_seconds  / 60)::integer                       AS worked_minutes,
+       ((r.worked_seconds - p.planned_seconds) / 60)::integer  AS variance_minutes,
+       r.first_in,
+       r.last_out,
+       r.break_count,
+       coalesce(r.is_open, false)                              AS is_open,
+       (r.person_id IS NULL)                                   AS absent,
+       (p.assignment_id IS NULL)                               AS outside_schedule,
+       r.open_since,
+       -- Por que este dia n\xE3o entra na soma. NULL = entra.
+       CASE
+         WHEN r.person_id IS NULL                 THEN NULL   -- escala sem ponto: n\xE3o h\xE1 o que somar
+         WHEN r.is_open                           THEN 'open'
+         WHEN (r.worked_seconds / 60) > public.workforce_max_shift_minutes()
+                                                  THEN 'span_too_long'
+       END                                                     AS review_reason
+  FROM planned p
+  FULL OUTER JOIN realized r
+    ON r.tenant_id = p.tenant_id
+   AND r.person_id = p.person_id
+   AND r.work_date = p.work_date;
+
+COMMENT ON VIEW public.v_workforce_day IS
+  'Jornada prevista \xD7 realizada por pessoa e dia. \`worked_minutes\` \xE9 sempre o MEDIDO; \`review_reason\` diz por que um dia n\xE3o entra na soma \u2014 \`open\` (n\xE3o terminou) ou \`span_too_long\` (fechou com dura\xE7\xE3o que n\xE3o \xE9 jornada, 004). Quem soma filtra por ela.';
+
+COMMENT ON COLUMN public.v_workforce_day.review_reason IS
+  'NULL = o dia conta. \`open\` = ponto em aberto. \`span_too_long\` = acima de workforce_max_shift_minutes(), que na pr\xE1tica \xE9 sa\xEDda n\xE3o batida e n\xE3o jornada longa (004).';
+
+GRANT SELECT ON public.v_workforce_day TO authenticated, service_role;
+`;
+var MIGRATION_005_A_FICHA_TRABALHISTA_TEM_ONDE_MORAR = `-- ---------------------------------------------------------------------------
+-- 005_a_ficha_trabalhista_tem_onde_morar.sql \u2014 o RH do V1 ganha destino.
+--
+-- Escrito a partir de \`~/dev/beautyplace/docs/v1-guide/rh\`, que documenta o
+-- m\xF3dulo do V1 andando nele: a Vis\xE3o Geral (oito cart\xF5es, tr\xEAs listas) e a Ficha
+-- de RH da pessoa (dezesseis vistas). O FLOW de cada um diz \`v2: status:
+-- missing\` \u2014 e dizia certo: n\xE3o havia nada disso aqui.
+--
+-- \u2500\u2500 O que este arquivo N\xC3O traz, e por qu\xEA \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- N\xE3o s\xE3o as dezesseis vistas. Medido na origem em 19/09/2026, nas 886 pessoas
+-- dos tr\xEAs tenants em porte:
+--
+--     as 12 tabelas de lista da Ficha        0 linhas \u2014 no V1 INTEIRO, n\xE3o s\xF3
+--     (f\xE9rias, faltas, advert\xEAncias,          nesses tenants
+--      treinamentos, avalia\xE7\xF5es, exames,
+--      EPIs, pend\xEAncias, dependentes,
+--      hist\xF3rico salarial, 13\xBA, benef\xEDcios)
+--     admission_date, dismissal_date,        0 preenchidos
+--     job_title, pis_pasep, CTPS, eSocial
+--     base_salary                            25 de 422
+--     contract_type                          2
+--
+-- O pr\xF3prio FLOW da Vis\xE3o Geral avisa: *"Num tenant rec\xE9m-migrado ele mostra
+-- headcount cheio e todo o resto zerado \u2014 e isso n\xE3o \xE9 defeito, \xE9 ficha vazia."*
+-- Aqui TODO tenant \xE9 assim. Desenhar dezesseis vistas para portar zero linha
+-- seria construir um formul\xE1rio de cada vez que algu\xE9m leu um FLOW.
+--
+-- Ent\xE3o vem o n\xFAcleo que sustenta o conceito e j\xE1 \xE9 \xFAtil no primeiro dia:
+--
+--     employment      o v\xEDnculo \u2014 \xE9 dele que saem headcount, admiss\xF5es,
+--                     demiss\xF5es, turnover e experi\xEAncia vencendo. Sem ele
+--                     nenhum n\xFAmero de RH existe, e \xE9 a vista 1 do V1
+--     vacations       f\xE9rias. Obriga\xE7\xE3o legal, recorrente, e a \xFAnica lista do
+--                     V1 que alimenta um cart\xE3o
+--     absences        faltas e afastamentos
+--     pending_items   pend\xEAncias \u2014 a outra lista que aparece no painel
+--
+-- As outras doze entram quando algu\xE9m for us\xE1-las. O que elas precisam j\xE1 est\xE1
+-- de p\xE9: a forma da tabela, o escopo, a permiss\xE3o e a view do painel.
+--
+-- \u2500\u2500 A permiss\xE3o, que o FLOW manda resolver ANTES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- V1-069: no V1 **n\xE3o h\xE1 permiss\xE3o separada para RH**. Quem edita cadastro v\xEA
+-- sal\xE1rio, CPF, dependentes e CID de atestado. O FLOW da Ficha fecha dizendo que
+-- portar s\xF3 vale "desde que a quest\xE3o da permiss\xE3o separada seja resolvida
+-- antes" \u2014 ent\xE3o ela \xE9 resolvida aqui, e n\xE3o depois.
+--
+-- \`workforce_hr.*\` \xE9 uma fam\xEDlia pr\xF3pria: quem tem \`workforce.read\` v\xEA escala e
+-- ponto e N\xC3O v\xEA sal\xE1rio. S\xE3o duas perguntas diferentes e agora t\xEAm duas
+-- respostas.
+--
+-- \u2500\u2500 O que o V2 faz e o V1 n\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O FLOW da vista 10 registra, como defeito: *"N\xE3o conversa com o ponto
+-- eletr\xF4nico nem com a escala: uma falta lan\xE7ada aqui n\xE3o aparece l\xE1."* No V1
+-- s\xE3o dois sistemas sobre a mesma pessoa que n\xE3o se olham \u2014 algu\xE9m de atestado
+-- aparece como FALTA na folha de ponto, e quem confere precisa lembrar de cabe\xE7a.
+--
+-- A \xA77 conserta: \`v_workforce_day\` passa a saber do afastamento. Um dia coberto
+-- por atestado deixa de ser "Falta" e passa a dizer o que foi. \xC9 a raz\xE3o de o RH
+-- morar no mesmo plugin do ponto, e n\xE3o ao lado dele.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 1. A PERMISS\xC3O SEPARADA (V1-069)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+INSERT INTO app.permissions (key, plugin, description) VALUES
+  ('workforce_hr.read',   'workforce_hr', 'Ver a ficha trabalhista: v\xEDnculo, sal\xE1rio, f\xE9rias, afastamentos e pend\xEAncias.'),
+  ('workforce_hr.create', 'workforce_hr', 'Lan\xE7ar na ficha trabalhista.'),
+  ('workforce_hr.edit',   'workforce_hr', 'Corrigir lan\xE7amento da ficha trabalhista.'),
+  ('workforce_hr.delete', 'workforce_hr', 'Excluir lan\xE7amento da ficha trabalhista.')
+ON CONFLICT (key) DO UPDATE SET plugin = EXCLUDED.plugin, description = EXCLUDED.description;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 2. O V\xCDNCULO
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Uma linha por pessoa, e n\xE3o colunas em \`public.people\`. Tr\xEAs raz\xF5es, e a
+-- terceira \xE9 a que decide:
+--
+--   \xB7 \`people\` \xE9 do core e atende cliente, fornecedor e profissional; quarenta
+--     colunas de CLT ali seriam nulas para a esmagadora maioria das linhas;
+--   \xB7 o V1 tem DUAS tabelas (professionals, employees) com os mesmos campos, e
+--     o V2 tem uma pessoa s\xF3 \u2014 a separa\xE7\xE3o \xE9 papel, n\xE3o cadastro;
+--   \xB7 e \xE9 a tabela que carrega o sal\xE1rio. Ela precisa de uma policy PR\xD3PRIA,
+--     e uma coluna n\xE3o tem policy: RLS \xE9 por tabela. Guardar sal\xE1rio em
+--     \`people\` seria reproduzir o V1-069 no schema.
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_employment (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id       uuid,
+  person_id     uuid NOT NULL REFERENCES public.people(id) ON DELETE CASCADE,
+
+  -- \u2500\u2500 v\xEDnculo (vista 1 do V1: Contrato) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- Vocabul\xE1rio exato do FLOW. Lista fechada porque \xE9 ela que decide encargo, e
+  -- "CLT " com espa\xE7o vira um tipo de contrato novo em sil\xEAncio.
+  contract_kind text CHECK (contract_kind IN
+    ('clt', 'pj', 'estagio', 'jovem_aprendiz', 'autonomo', 'socio', 'temporario', 'intermitente')),
+  admission_date date,
+  dismissal_date date,
+  dismissal_reason text,
+  -- O V1 tem os dois: o fim da PRIMEIRA experi\xEAncia e o fim FINAL. \xC9 o segundo
+  -- que alimenta o cart\xE3o "Experi\xEAncia vencendo".
+  probation_first_end date,
+  probation_final_end date,
+  job_title     text,
+  department    text,
+  schedule_regime text CHECK (schedule_regime IN
+    ('mensalista', 'horista', 'diarista', 'escala_12x36', 'escala_6x1', 'escala_5x2')),
+  weekly_hours  numeric(5,2),
+  monthly_hours numeric(6,2),
+  esocial_registration text,
+
+  -- \u2500\u2500 remunera\xE7\xE3o (vista 2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- Valor de REFER\xCANCIA, e o V1 diz isso com todas as letras: nada aqui vira
+  -- conta a pagar, comiss\xE3o ou desconto. O coment\xE1rio fica porque a coluna
+  -- chamada \`base_salary\` convida a supor o contr\xE1rio.
+  base_salary   numeric(14,2),
+  pay_frequency text CHECK (pay_frequency IN ('mensal', 'quinzenal', 'semanal', 'diario', 'por_hora')),
+  -- Os quinze aux\xEDlios e adicionais da vista 2 em jsonb, e n\xE3o em quinze
+  -- colunas. Medido: ZERO deles preenchido nas 886 pessoas. Quinze colunas
+  -- nulas seriam quinze decis\xF5es de schema tomadas sem um caso de uso; a chave
+  -- que a casa usar aparece aqui e vira coluna quando pagar a passagem.
+  allowances    jsonb NOT NULL DEFAULT '{}'::jsonb,
+
+  notes         text,
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  -- Um v\xEDnculo por pessoa. Recontrata\xE7\xE3o reabre o mesmo, com a data nova \u2014 o
+  -- hist\xF3rico de quem saiu e voltou \xE9 uma vista de lista que ainda n\xE3o existe,
+  -- e inventar a segunda linha agora criaria dois headcounts para uma pessoa.
+  CONSTRAINT plg_workforce_employment_person UNIQUE (tenant_id, person_id),
+  -- Demiss\xE3o antes da admiss\xE3o n\xE3o \xE9 dado ruim, \xE9 dado imposs\xEDvel.
+  CONSTRAINT plg_workforce_employment_dates
+    CHECK (dismissal_date IS NULL OR admission_date IS NULL OR dismissal_date >= admission_date)
+);
+
+COMMENT ON TABLE public.plg_workforce_employment IS
+  'O v\xEDnculo trabalhista de uma pessoa (005). \xC9 dele que saem headcount, admiss\xF5es, demiss\xF5es, turnover e experi\xEAncia vencendo. Tabela pr\xF3pria e n\xE3o colunas em people: RLS \xE9 por tabela, e \xE9 o sal\xE1rio que precisa da policy.';
+COMMENT ON COLUMN public.plg_workforce_employment.base_salary IS
+  'Valor de REFER\xCANCIA. N\xE3o vira conta a pagar, comiss\xE3o nem desconto \u2014 o V1 tamb\xE9m n\xE3o fazia isso, e o nome da coluna convida a supor que faz.';
+COMMENT ON COLUMN public.plg_workforce_employment.allowances IS
+  'Aux\xEDlios e adicionais (VT, VR, VA, plano, creche, noturno, insalubridade\u2026). Em jsonb porque os quinze campos da vista 2 do V1 est\xE3o vazios nas 886 pessoas medidas: vira coluna quando algu\xE9m pagar a passagem.';
+
+CREATE INDEX IF NOT EXISTS plg_workforce_employment_tenant_person
+  ON public.plg_workforce_employment (tenant_id, person_id);
+CREATE INDEX IF NOT EXISTS plg_workforce_employment_ativo
+  ON public.plg_workforce_employment (tenant_id) WHERE dismissal_date IS NULL;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 3. F\xC9RIAS (vista 8)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_vacations (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id       uuid,
+  person_id     uuid NOT NULL REFERENCES public.people(id) ON DELETE CASCADE,
+  -- O per\xEDodo AQUISITIVO: o que a pessoa ganhou. \xC9 o \`accrual_end\` que alimenta
+  -- "F\xE9rias vencendo (60d)".
+  accrual_start date NOT NULL,
+  accrual_end   date NOT NULL,
+  -- O per\xEDodo de GOZO: quando ela tirou. Nulo \xE9 o estado normal de quem ainda
+  -- n\xE3o programou.
+  taken_start   date,
+  taken_end     date,
+  days_taken    integer,
+  days_sold     integer,
+  advance_13th  boolean NOT NULL DEFAULT false,
+  -- Digitado, como no V1. O sistema N\xC3O calcula o ter\xE7o \u2014 e escrever isso aqui
+  -- \xE9 o que impede algu\xE9m de supor que a coluna vazia \xE9 um bug.
+  constitutional_third numeric(14,2),
+  status        text NOT NULL DEFAULT 'pendente'
+                CHECK (status IN ('pendente', 'programada', 'em_gozo', 'concluida', 'vencida')),
+  notes         text,
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_workforce_vacations_accrual CHECK (accrual_end >= accrual_start),
+  CONSTRAINT plg_workforce_vacations_taken
+    CHECK (taken_end IS NULL OR taken_start IS NULL OR taken_end >= taken_start)
+);
+
+COMMENT ON TABLE public.plg_workforce_vacations IS
+  'Per\xEDodo aquisitivo e de gozo de f\xE9rias (005). Nada \xE9 calculado, inclusive o ter\xE7o constitucional \u2014 \xE9 digitado, como no V1.';
+
+CREATE INDEX IF NOT EXISTS plg_workforce_vacations_vencendo
+  ON public.plg_workforce_vacations (tenant_id, accrual_end) WHERE status <> 'concluida';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 4. FALTAS E AFASTAMENTOS (vista 10)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_absences (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id       uuid,
+  person_id     uuid NOT NULL REFERENCES public.people(id) ON DELETE CASCADE,
+  kind          text NOT NULL CHECK (kind IN
+    ('falta_justificada', 'falta_injustificada', 'atestado', 'licenca_maternidade',
+     'licenca_paternidade', 'licenca_nao_remunerada', 'suspensao', 'ferias', 'afastamento_inss')),
+  starts_on     date NOT NULL,
+  -- Nulo = afastamento em aberto, que \xE9 um estado real (INSS sem alta marcada).
+  ends_on       date,
+  days          integer,
+  paid          boolean NOT NULL DEFAULT true,
+  -- Dado m\xE9dico. Mora aqui e n\xE3o em \`people\` pelo mesmo motivo do sal\xE1rio: \xE9 a
+  -- policy de \`workforce_hr\` que o protege, e V1-069 \xE9 exatamente sobre isto.
+  icd_code      text,
+  doctor        text,
+  notes         text,
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_workforce_absences_span CHECK (ends_on IS NULL OR ends_on >= starts_on)
+);
+
+COMMENT ON TABLE public.plg_workforce_absences IS
+  'Falta e afastamento (005). Diferente do V1, CONVERSA com o ponto: v_workforce_day l\xEA daqui, e um dia coberto por atestado deixa de aparecer como falta.';
+COMMENT ON COLUMN public.plg_workforce_absences.icd_code IS
+  'CID do atestado. Dado de sa\xFAde: \xE9 a policy de workforce_hr que o separa de quem edita cadastro \u2014 o V1 n\xE3o separava (V1-069).';
+
+CREATE INDEX IF NOT EXISTS plg_workforce_absences_periodo
+  ON public.plg_workforce_absences (tenant_id, person_id, starts_on, ends_on);
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 5. PEND\xCANCIAS (vista 16)
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+CREATE TABLE IF NOT EXISTS public.plg_workforce_pending_items (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id       uuid,
+  person_id     uuid NOT NULL REFERENCES public.people(id) ON DELETE CASCADE,
+  title         text NOT NULL,
+  category      text CHECK (category IN ('documento', 'exame', 'epi', 'treinamento', 'assinatura', 'outro')),
+  priority      text NOT NULL DEFAULT 'normal' CHECK (priority IN ('baixa', 'normal', 'alta', 'urgente')),
+  due_on        date,
+  resolved_at   timestamptz,
+  description   text,
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE public.plg_workforce_pending_items IS
+  'O que falta na pasta de algu\xE9m: documento, exame, EPI, assinatura (005). \xC9 a lista que o painel cobra \u2014 "Pend\xEAncias cr\xEDticas" conta as n\xE3o resolvidas de prioridade alta ou urgente.';
+
+CREATE INDEX IF NOT EXISTS plg_workforce_pending_abertas
+  ON public.plg_workforce_pending_items (tenant_id, priority, due_on) WHERE resolved_at IS NULL;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 6. ESCOPO, CARIMBO E PERMISS\xC3O
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN SELECT * FROM (VALUES
+      ('plg_workforce_employment',    'workforce_hr.employment'),
+      ('plg_workforce_vacations',     'workforce_hr.vacation'),
+      ('plg_workforce_absences',      'workforce_hr.absence'),
+      ('plg_workforce_pending_items', 'workforce_hr.pending_item')
+    ) AS t(tbl, resource)
+  LOOP
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', r.tbl);
+    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', r.tbl);
+    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', r.tbl || '_updated_at', r.tbl);
+    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()',
+                   r.tbl || '_updated_at', r.tbl);
+    -- \`workforce_hr\` e n\xE3o \`workforce\`: \xE9 o nome do plugin que o scaffold usa
+    -- para derivar \`<plugin>.read/create/edit/delete\`, ent\xE3o passar outro nome
+    -- aqui \xC9 a separa\xE7\xE3o de permiss\xE3o. Quem tem workforce.read v\xEA escala e
+    -- ponto e n\xE3o v\xEA sal\xE1rio.
+    PERFORM app.scaffold_table(format('public.%I', r.tbl)::regclass, r.resource, 'workforce_hr', false, 'enforce');
+  END LOOP;
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 7. O PONTO PASSA A SABER DO AFASTAMENTO
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- O defeito que o FLOW da vista 10 registra: *"N\xE3o conversa com o ponto
+-- eletr\xF4nico nem com a escala."* Duas telas sobre a mesma pessoa, no mesmo
+-- sistema, que n\xE3o se olham \u2014 quem confere ponto v\xEA FALTA em cima de um
+-- atestado que o RH lan\xE7ou na semana passada, e precisa lembrar de cabe\xE7a.
+--
+-- A view n\xE3o muda de forma: ganha uma coluna no fim. \`absent\` continua sendo
+-- escala sem ponto, porque \xE9 isso que ele \xE9; o que muda \xE9 que agora d\xE1 para
+-- dizer POR QUE, quando algu\xE9m sabe.
+
+CREATE OR REPLACE VIEW public.v_workforce_day
+WITH (security_invoker = 'true') AS
+WITH bruto AS (
+  SELECT e.tenant_id, e.unit_id, e.person_id, e.work_date,
+         min(e.effective_at) FILTER (WHERE e.kind = 'clock_in')  AS first_in,
+         max(e.effective_at) FILTER (WHERE e.kind = 'clock_out') AS last_out,
+         count(*) FILTER (WHERE e.kind = 'break_start')          AS break_count,
+         count(*) FILTER (WHERE e.kind IN ('clock_in', 'break_end'))    AS aberturas,
+         count(*) FILTER (WHERE e.kind IN ('clock_out', 'break_start')) AS fechamentos,
+         max(e.effective_at) FILTER (WHERE e.kind IN ('clock_in', 'break_end')) AS ultima_abertura,
+         sum(CASE
+               WHEN e.kind IN ('clock_out', 'break_start') THEN  extract(epoch FROM e.effective_at)
+               WHEN e.kind IN ('clock_in',  'break_end')   THEN -extract(epoch FROM e.effective_at)
+             END) AS soma_com_sinal
+    FROM public.v_workforce_time_entries e
+   WHERE NOT e.voided
+   GROUP BY e.tenant_id, e.unit_id, e.person_id, e.work_date
+),
+realized AS (
+  SELECT b.tenant_id, b.unit_id, b.person_id, b.work_date,
+         b.first_in, b.last_out, b.break_count,
+         (b.aberturas <> b.fechamentos) AS is_open,
+         CASE WHEN b.aberturas <> b.fechamentos THEN b.ultima_abertura END AS open_since,
+         -- Devolve \xE0 soma a abertura sem par (003).
+         (b.soma_com_sinal
+            + CASE WHEN b.aberturas <> b.fechamentos
+                   THEN extract(epoch FROM b.ultima_abertura)
+                   ELSE 0 END) AS worked_seconds
+    FROM bruto b
+),
+planned AS (
+  SELECT a.tenant_id, a.unit_id, a.person_id,
+         s.schedule_date AS work_date,
+         a.id AS assignment_id, a.role, a.status AS assignment_status,
+         a.shift_label, a.shift_start_time, a.shift_end_time,
+         (extract(epoch FROM a.shift_end_time - a.shift_start_time)
+            + CASE WHEN a.shift_end_time <= a.shift_start_time THEN 86400 ELSE 0 END) AS planned_seconds
+    FROM public.plg_workforce_schedule_assignments a
+    JOIN public.plg_workforce_schedules s ON s.id = a.schedule_id
+   WHERE s.status IN ('published', 'closed')
+     AND a.role = 'titular'
+     AND a.shift_start_time IS NOT NULL
+     AND a.shift_end_time IS NOT NULL
+)
+SELECT coalesce(p.tenant_id, r.tenant_id) AS tenant_id,
+       coalesce(p.unit_id,   r.unit_id)   AS unit_id,
+       coalesce(p.person_id, r.person_id) AS person_id,
+       coalesce(p.work_date, r.work_date) AS work_date,
+       p.assignment_id,
+       p.shift_label,
+       p.shift_start_time,
+       p.shift_end_time,
+       p.assignment_status,
+       (p.planned_seconds / 60)::integer                       AS planned_minutes,
+       (r.worked_seconds  / 60)::integer                       AS worked_minutes,
+       ((r.worked_seconds - p.planned_seconds) / 60)::integer  AS variance_minutes,
+       r.first_in,
+       r.last_out,
+       r.break_count,
+       coalesce(r.is_open, false)                              AS is_open,
+       (r.person_id IS NULL)                                   AS absent,
+       (p.assignment_id IS NULL)                               AS outside_schedule,
+       r.open_since,
+       CASE
+         WHEN r.person_id IS NULL                 THEN NULL
+         WHEN r.is_open                           THEN 'open'
+         WHEN (r.worked_seconds / 60) > public.workforce_max_shift_minutes()
+                                                  THEN 'span_too_long'
+       END                                                     AS review_reason,
+       -- Coluna nova, no fim. \`security_invoker\` na view + a policy de
+       -- \`workforce_hr\` na tabela: quem n\xE3o tem a permiss\xE3o simplesmente n\xE3o
+       -- enxerga o afastamento, e a coluna volta nula. A folha de ponto n\xE3o
+       -- vira a porta dos fundos do CID.
+       (SELECT a.kind
+          FROM public.plg_workforce_absences a
+         WHERE a.tenant_id = coalesce(p.tenant_id, r.tenant_id)
+           AND a.person_id = coalesce(p.person_id, r.person_id)
+           AND coalesce(p.work_date, r.work_date) BETWEEN a.starts_on
+               AND coalesce(a.ends_on, coalesce(p.work_date, r.work_date))
+         ORDER BY a.starts_on DESC
+         LIMIT 1)                                              AS absence_kind
+  FROM planned p
+  FULL OUTER JOIN realized r
+    ON r.tenant_id = p.tenant_id
+   AND r.person_id = p.person_id
+   AND r.work_date = p.work_date;
+
+COMMENT ON COLUMN public.v_workforce_day.absence_kind IS
+  'O afastamento que cobre este dia, quando o RH lan\xE7ou um (005). \xC9 o conserto do defeito que o V1 tem: l\xE1 a falta lan\xE7ada no RH n\xE3o aparece no ponto, e quem confere v\xEA FALTA em cima de um atestado.';
+
+GRANT SELECT ON public.v_workforce_day TO authenticated, service_role;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- 8. A VIS\xC3O GERAL \u2014 os oito n\xFAmeros
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Os mesmos oito cart\xF5es do V1, com tr\xEAs diferen\xE7as, e as tr\xEAs s\xE3o conserto de
+-- defeito registrado no FLOW:
+--
+--   V1-072  "Experi\xEAncia vencendo" s\xF3 olhava PROFISSIONAIS, porque o V1 tem
+--           duas tabelas. O V2 tem uma pessoa, ent\xE3o olha todo mundo.
+--   V1-073  "F\xE9rias a vencer" mostrava a data e N\xC3O o nome. Aqui a view devolve
+--           person_id e nome, e a tela linka para a ficha.
+--   V1-074  aniversariante do dia 1\xBA ca\xEDa no m\xEAs anterior, por compara\xE7\xE3o de
+--           data em UTC. \`extract(month \u2026)\` n\xE3o tem esse problema.
+
+CREATE OR REPLACE VIEW public.v_workforce_hr_overview
+WITH (security_invoker = 'true') AS
+WITH base AS (
+  SELECT e.tenant_id, e.person_id, e.admission_date, e.dismissal_date, e.probation_final_end,
+         p.name, p.date_of_birth, p.is_active
+    FROM public.plg_workforce_employment e
+    JOIN public.people p ON p.id = e.person_id
+)
+SELECT b.tenant_id,
+       count(*) FILTER (WHERE b.dismissal_date IS NULL AND coalesce(b.is_active, true))         AS headcount,
+       count(*) FILTER (WHERE b.admission_date  >= current_date - 30)                           AS admissions_30d,
+       count(*) FILTER (WHERE b.dismissal_date  >= current_date - 30)                           AS dismissals_30d,
+       count(*) FILTER (WHERE b.probation_final_end BETWEEN current_date AND current_date + 60) AS probation_ending,
+       count(*) FILTER (WHERE b.dismissal_date IS NULL
+                          AND extract(month FROM b.date_of_birth) = extract(month FROM current_date)) AS birthdays_this_month,
+       (SELECT count(*) FROM public.plg_workforce_vacations v
+         WHERE v.tenant_id = b.tenant_id AND v.status <> 'concluida'
+           AND v.accrual_end BETWEEN current_date AND current_date + 60)                        AS vacations_due_60d,
+       (SELECT count(*) FROM public.plg_workforce_pending_items i
+         WHERE i.tenant_id = b.tenant_id AND i.resolved_at IS NULL
+           AND i.priority IN ('alta', 'urgente'))                                               AS critical_pending
+  FROM base b
+ GROUP BY b.tenant_id;
+
+COMMENT ON VIEW public.v_workforce_hr_overview IS
+  'Os oito n\xFAmeros do painel de RH do V1 (005). Turnover n\xE3o est\xE1 aqui de prop\xF3sito: \xE9 demiss\xF5es \xF7 headcount, e uma divis\xE3o que a tela faz \xE9 uma divis\xE3o que a tela pode formatar \u2014 a view devolve as duas parcelas.';
+
+-- Quem vence, COM NOME \u2014 o V1-073 \xE9 justamente a lista sem nome.
+CREATE OR REPLACE VIEW public.v_workforce_hr_upcoming
+WITH (security_invoker = 'true') AS
+SELECT v.tenant_id, 'vacation'::text AS kind, v.person_id, p.name AS person_name,
+       v.accrual_end AS due_on, v.status AS detail
+  FROM public.plg_workforce_vacations v
+  JOIN public.people p ON p.id = v.person_id
+ WHERE v.status <> 'concluida' AND v.accrual_end BETWEEN current_date AND current_date + 60
+UNION ALL
+SELECT e.tenant_id, 'probation', e.person_id, p.name,
+       e.probation_final_end, e.job_title
+  FROM public.plg_workforce_employment e
+  JOIN public.people p ON p.id = e.person_id
+ WHERE e.probation_final_end BETWEEN current_date AND current_date + 60
+UNION ALL
+SELECT i.tenant_id, 'pending', i.person_id, p.name, i.due_on, i.title
+  FROM public.plg_workforce_pending_items i
+  JOIN public.people p ON p.id = i.person_id
+ WHERE i.resolved_at IS NULL AND i.priority IN ('alta', 'urgente');
+
+COMMENT ON VIEW public.v_workforce_hr_upcoming IS
+  'O que vence nos pr\xF3ximos 60 dias, com o NOME de quem (005). O V1 lista f\xE9rias a vencer s\xF3 com a data \u2014 V1-073 \u2014, o que obriga a procurar a pessoa em outra tela.';
+
+GRANT SELECT ON public.v_workforce_hr_overview TO authenticated, service_role;
+GRANT SELECT ON public.v_workforce_hr_upcoming TO authenticated, service_role;
+`;
+var MIGRATION_006_O_CUSTO_DE_PESSOAL_E_UM_RAMO_DO_PLANO = `-- O custo de pessoal \xE9 um RAMO DO PLANO, e quem o aponta \xE9 a casa.
+--
+-- \u2500\u2500 O defeito, medido \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A tela "Encargos e honor\xE1rios" (RH \u2192 Custos) l\xEA o raz\xE3o do Financeiro e soma
+-- toda linha de conta a pagar que tenha conta cont\xE1bil. Toda. Medido no cluster
+-- de Pertinho do C\xE9u em 19/09/2026, o que ela chamava de custo de pessoal
+-- inclu\xEDa:
+--
+--     6.2.1  Aluguel                    R$  21.061,99
+--     6.2.3  IPTU                       R$  26.613,73
+--     6.5.5  ICMS                       R$  30.964,92
+--     6.4.1  Equipamentos               R$  82.595,87
+--     6.3.1  Energia/Light              R$  27.185,62
+--
+-- \u2014 ao lado das que s\xE3o, de fato, pessoal:
+--
+--     5      DESPESAS COM PESSOAL   (26 contas: Sal\xE1rio, FGTS, INSS, Comiss\xE3o,
+--            Hora Extra, Adiantamento, IRRF Folha, Vale Alimenta\xE7\xE3o, FREELANCER
+--            com oito filhas\u2026)
+--
+-- Um total que soma aluguel e ICMS sob o t\xEDtulo "custo de pessoal" n\xE3o est\xE1
+-- impreciso: est\xE1 errado, e erra para cima, que \xE9 o lado que faz algu\xE9m decidir
+-- contratar menos.
+--
+-- \u2500\u2500 Por que uma configura\xE7\xE3o, e n\xE3o uma regra \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- N\xE3o existe como o c\xF3digo saber qual ramo \xE9 pessoal. O plano de contas \xE9 uma
+-- DECLARA\xC7\xC3O da casa (ver \`040_o_demonstrativo_mostra_o_plano_inteiro\`), e cada
+-- casa numera o dela: aqui pessoal \xE9 o ramo \`5\`; o template que o SDK semeia
+-- para um tenant novo p\xF5e folha em \`4.03\`. Deduzir pelo NOME da conta seria
+-- adivinhar em portugu\xEAs \u2014 e \`8.2.4 Rescis\xE3o\` e \`8.2.6 Pro-labore\`, que tamb\xE9m
+-- s\xE3o gente, moram fora do ramo 5 neste mesmo plano, por escolha de quem montou.
+--
+-- Ent\xE3o a chave guarda a escolha, e a aus\xEAncia dela \xE9 uma aus\xEAncia honesta: sem
+-- nada escolhido a tela mostra TODAS as despesas classificadas e diz que \xE9 o que
+-- est\xE1 fazendo. Um padr\xE3o inventado ('5') faria a tela mentir com convic\xE7\xE3o no
+-- primeiro tenant cujo plano n\xE3o usa esse n\xFAmero.
+--
+-- \u2500\u2500 A forma \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Um array de C\xD3DIGOS, n\xE3o de ids. O c\xF3digo \xE9 o que carrega a hierarquia: quem
+-- escolhe '5' escolhe o ramo inteiro \u2014 '5.4' e '5.4.1' entram com ele, e uma
+-- conta nova criada amanh\xE3 dentro do ramo entra sozinha. Com id seria preciso
+-- re-marcar a configura\xE7\xE3o a cada conta nova, e ningu\xE9m lembra.
+--
+-- \`tenant_setting_set\` cobra \`settings.manage\` e recusa chave n\xE3o registrada \u2014
+-- \xE9 por isso que este arquivo existe. Idempotente: \`seed_setting_keys\` faz
+-- upsert por chave.
+
+SELECT app.seed_setting_keys($$[
+  {
+    "key": "workforce.payroll_account_codes", "type": "array", "default": null,
+    "reader": "plugin:workforce",
+    "description": "Os ramos do plano de contas que s\xE3o custo de pessoal, por c\xF3digo ('5', '8.2.4'). Um c\xF3digo traz toda a descend\xEAncia dele. Vazio ou nulo = a tela mostra todas as despesas classificadas e avisa que n\xE3o h\xE1 ramo escolhido."
+  }
+]$$::jsonb);
+`;
+var MIGRATION_007_A_PORTA_DE_SERVICO_DO_PONTO_FECHA_TAMBEM = `-- ---------------------------------------------------------------------------
+-- 007_a_porta_de_servico_do_ponto_fecha_tambem.sql
+--
+-- \u2500\u2500 o buraco, e por que ele estava invis\xEDvel \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- As fun\xE7\xF5es que este plugin cria em \`migration\` nasceram execut\xE1veis por
+-- PUBLIC \u2014 \xE9 o padr\xE3o do Postgres, e ningu\xE9m revogou. Elas s\xE3o
+-- \`SECURITY DEFINER\` e escrevem dados de QUALQUER inquilino: uma delas
+-- alcan\xE7\xE1vel pela chave an\xF4nima \xE9 a base inteira alcan\xE7\xE1vel pela chave
+-- an\xF4nima.
+--
+-- Isto n\xE3o aparecia porque a \`000_baseline\` falhava e levava junto os outros
+-- seis arquivos deste plugin \u2014 as fun\xE7\xF5es nunca chegavam a existir na bancada.
+-- Com a baseline consertada (#443) o passo inteiro passou a aplicar, e as duas
+-- su\xEDtes que guardam esta fronteira ficaram vermelhas na hora:
+--
+--   090_migration_ledger/001  "no migration function is executable by anon
+--                              or authenticated" \u2014 have 9, want 0
+--   crm/009                   "nenhuma fun\xE7\xE3o do schema migration \xE9 cham\xE1vel
+--                              por anon" \u2014 have 9, want 0
+--
+-- Ou seja: a regra sempre esteve escrita e medida; o que faltava era o plugin
+-- chegar ao banco para ser medido. \xC9 o argumento do #338 de novo \u2014 um plugin
+-- fora da corrente \xE9 um plugin cujas tabelas (e cujas portas) s\xE3o coincid\xEAncia.
+--
+-- \u2500\u2500 por extenso, e n\xE3o varrendo o cat\xE1logo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A tenta\xE7\xE3o \xE9 \`REVOKE\` num la\xE7o sobre \`pg_proc\`. J\xE1 foi tentado neste repo e
+-- derrubou 35 su\xEDtes: varrer revoga de fun\xE7\xF5es que outros passos criaram e
+-- precisam de execu\xE7\xE3o. Revogar em massa \xE9 f\xE1cil de escrever e imposs\xEDvel de
+-- revisar. A lista abaixo \xE9 a das fun\xE7\xF5es DESTE plugin, nomeada uma a uma.
+-- ---------------------------------------------------------------------------
+
+DO $$
+DECLARE
+  v_fn   text;
+  v_args text;
+  v_n    integer := 0;
+BEGIN
+  -- Cada writer do de-para, com a assinatura que a corrente lhe deu. Nomear em
+  -- vez de varrer \xE9 o que torna esta lista revis\xE1vel.
+  FOR v_fn, v_args IN
+    SELECT p.proname, pg_get_function_identity_arguments(p.oid)
+      FROM pg_proc p
+      JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = 'migration'
+       AND (p.proname LIKE 'upsert_wf\\_%' OR p.proname IN ('_wf_person', '_point_punch_photo'))
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION migration.%I(%s) FROM PUBLIC, anon, authenticated', v_fn, v_args);
+    -- \`service_role\` fica: \xE9 quem a importa\xE7\xE3o usa, e \xE9 a \xFAnica identidade que
+    -- tem raz\xE3o para atravessar inquilinos.
+    EXECUTE format('GRANT EXECUTE ON FUNCTION migration.%I(%s) TO service_role', v_fn, v_args);
+    v_n := v_n + 1;
+  END LOOP;
+
+  RAISE NOTICE 'workforce/007: % fun\xE7\xE3o(\xF5es) de migration fechadas a anon e authenticated', v_n;
+END $$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_a_prova_da_batida_tem_bytes", sql: MIGRATION_001_A_PROVA_DA_BATIDA_TEM_BYTES },
+  { id: "002_o_guarda_da_foto_olhava_o_nome_errado", sql: MIGRATION_002_O_GUARDA_DA_FOTO_OLHAVA_O_NOME_ERRADO },
+  { id: "003_o_ponto_em_aberto_para_de_mentir_a_duracao", sql: MIGRATION_003_O_PONTO_EM_ABERTO_PARA_DE_MENTIR_A_DURACAO },
+  { id: "004_a_jornada_implausivel_nao_soma", sql: MIGRATION_004_A_JORNADA_IMPLAUSIVEL_NAO_SOMA },
+  { id: "005_a_ficha_trabalhista_tem_onde_morar", sql: MIGRATION_005_A_FICHA_TRABALHISTA_TEM_ONDE_MORAR },
+  { id: "006_o_custo_de_pessoal_e_um_ramo_do_plano", sql: MIGRATION_006_O_CUSTO_DE_PESSOAL_E_UM_RAMO_DO_PLANO },
+  { id: "007_a_porta_de_servico_do_ponto_fecha_tambem", sql: MIGRATION_007_A_PORTA_DE_SERVICO_DO_PONTO_FECHA_TAMBEM }
+];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE, MIGRATION_001_A_PROVA_DA_BATIDA_TEM_BYTES, MIGRATION_002_O_GUARDA_DA_FOTO_OLHAVA_O_NOME_ERRADO, MIGRATION_003_O_PONTO_EM_ABERTO_PARA_DE_MENTIR_A_DURACAO, MIGRATION_004_A_JORNADA_IMPLAUSIVEL_NAO_SOMA, MIGRATION_005_A_FICHA_TRABALHISTA_TEM_ONDE_MORAR, MIGRATION_006_O_CUSTO_DE_PESSOAL_E_UM_RAMO_DO_PLANO, MIGRATION_007_A_PORTA_DE_SERVICO_DO_PONTO_FECHA_TAMBEM };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map