The metadata-filtered purge inventory — the offboarding coverage for
tables whose tenant is a JSON metadata.tenantId (stamped by the schedules
facade at create + the tick on every trigger), not a salted id column. Both
schedule tables are here: schedule rows and their trigger history. The DELETE is
WHERE json_extract(metadata, '$.tenantId') = ? (the same SQLite json_extract
the run-snapshot purge already uses on snapshot), so a NULL/absent metadata
never matches — every row our facade/tick writes carries it, so this reaps them
all. Ordering is not load-bearing (deletes run concurrently; see purgeTenant).
The metadata-filtered purge inventory — the offboarding coverage for tables whose tenant is a JSON
metadata.tenantId(stamped by the schedules facade at create + the tick on every trigger), not a salted id column. Both schedule tables are here: schedule rows and their trigger history. The DELETE isWHERE json_extract(metadata, '$.tenantId') = ?(the same SQLite json_extract the run-snapshot purge already uses onsnapshot), so a NULL/absent metadata never matches — every row our facade/tick writes carries it, so this reaps them all. Ordering is not load-bearing (deletes run concurrently; see purgeTenant).