Clear deleted documents' titles from older clean-up ledger rows (database)

Merged
BI
23d ago
+22-2

Summary

  • Before: when a document was deleted, its title was copied into storage_cleanup_jobs.document_title and kept there indefinitely (audit ING-A-05). The companion code PR stops that for new deletes.
  • After: a one-off data backfill clears the title on older rows whose document is gone (document_id already nulled by the ON DELETE SET NULL foreign key). A row for an aborted delete still points at its live document and keeps its title.
  • Database change, exactly: one UPDATE public.storage_cleanup_jobs SET document_title = null WHERE document_title IS NOT NULL AND document_id IS NULL. There are no schema, function, grant or policy changes.
  • Merge only after the owner's explicit yes to this database change. Merging applies it to the live database within seconds.

RAG impact: no retrieval behaviour change - data backfill on the storage clean-up ledger only.

Clinical Governance Preflight

  • Source verification: no change.
  • Patient-data handling: it removes possibly identifying titles of deleted documents.
  • Service-role confinement: no change.

Verification

  • check:migration-role: Hosted migration-role guard passed. The migration is sealed with migrations:seal (new entry only).
  • tests/migration-history-guards.test.ts and tests/supabase-schema.test.ts: 177 passed.

Risk and rollout

  • Risk: low. It only nulls a text column on rows of deleted documents.
  • Rollback: none needed. The titles are not used by the app.
  • Provider or production effects: the live database is changed on merge.

Generated by Claude Code

Summary by cubic

Clears titles of deleted documents from older storage_cleanup_jobs rows so the ledger no longer retains possibly identifying data indefinitely.

The companion code change stops this behavior for new deletes; this one-off backfill handles rows written before it. document_id is already nulled by the ON DELETE SET NULL foreign key, so the backfill only touches rows whose document is gone. Rows for aborted deletes keep their title, and public-source rows are excluded because they also have a null document_id but a fixed title guarded by a trigger.

This is a database change only: one update statement that nulls document_title. No schema, function, grant, or policy changes. Merging applies it to the live database within seconds, so merge only after the owner's explicit yes.