RTBF runbook

# RTBF operator runbook (pilot)

Deletion requests appear in **Ops → Deletion requests** (`/ops/rtbf`). Each row is a `system_setting` key `rtbf_request:<userId>`.

## Queue statuses (in-app)

| Status | Meaning |
|--------|---------|
| `pending` | User submitted; not yet triaged |
| `acknowledged` | Operator confirmed receipt |
| `in_progress` | Anonymisation work started |

Status updates are stored in the same `system_setting.value` JSON as the request timestamp. **Automated scrubbing is not implemented in the app** — complete removal in Supabase per spec-phase-8-patterns.md § D.3.

## Anonymisation routine (Supabase)

1. Confirm the user ID from the queue matches the account to remove.
2. Read `system_setting` key `rtbf_counter` (default `0`). Note the next label index `n = counter + 1`.
3. In a transaction:
   - Set `app_user.status` to `removed`.
   - Scrub PII: `first_name` → `deleteduser{n}`, `email` → `deleteduser{n}@pawprint.eco`, clear `password_hash` and `totp_secret`.
   - Increment `rtbf_counter` to `n`.
4. Do **not** alter calculation snapshot fields on `user_action_record` (audit integrity).
5. Email the user confirmation when complete.
6. Optionally delete or archive the `rtbf_request:<userId>` row after completion.

## Pilot limitations

- No in-app “complete” button; mark progress with **Acknowledge** / **In progress** only.
- Demo mode (no service role) shows a sample queue; status buttons require live Supabase.