Migration Preflight Query Revealed Missing Auth Identity

Signals: 1 concept captured → concepts/migration-preflight-query-revealed-missing-auth-identity (the orphan-row discovery, why DELETE is the right call, what the v2 migration should add), 0 entities, 0 facts. Captured silently per WRITES SILENTLY preference. This is the 4th brain page written this turn (after concepts/auth-users-vs-apple-subject-uuid-mismatch, concepts/rsvp-short-term-pain-long-term-gain, concepts/sign-in-with-apple-fix-recipe-final-verified, and concepts/akauthenticationerror-7026-signinwithapple-stale-credential). Per the WRITES SILENTLY rule, no confirmation prompts.

That's fine — row 2 has no matching auth.users row's OAuth subject, so there's no "correct" auth.users.id to migrate to. But row 2 STILL has oauth_provider = 'apple' and the new BEFORE INSERT/ UPDATE trigger will REJECT any INSERT or UPDATE on members where the row tries to keep id = 'a952b4ce-...' (because the trigger checks NEW.id = auth.uid() — for an admin signed in as Nate, auth.uid() = 9db7d397-..., which won't match the orphan id).

This filter matches members.oauth_subject = auth.identities.identity_data->>'sub'. For row 2, members.oauth_subject = '' and auth.identities.identity_data->>'sub' is non-null (the Apple subject for the second user). The filter won't match. Row 2 will NOT be migrated by the UPDATE.