fix(db): refuse a negative item index on field corrections (#47)

CHANGELOG.md

@@ -77,3 +77,5 @@ This file records what changes **in the product** – process and session state
 - AI verifier: a unit quoted together with the neighbouring table cell (e.g. `60    | Stk.`) is now
   confirmed as `found` when one cell of the quote is exactly the unit; quotes that differ from the
   source in real characters are still rejected (#50).
+- The database refuses a line-item correction with a negative position, like it already does for
+  extracted values – defence in depth below the review check (#47).

docs/technical/data-model.md

@@ -57,7 +57,7 @@ All three: `company_id`, forced RLS, composite FKs to the run and request of the
 | Column | Type | Notes | Class |
 |---|---|---|---|
 | `id`, `company_id`, `request_id` | uuid | composite FK `(request_id, company_id)` → `requests` | internal |
-| `field_key`, `item_index` | text, int | header field key (six, schema v2), or a line-item field key with its position (`item_index`, #25; null for header fields) | internal |
+| `field_key`, `item_index` | text, int | header field key (six, schema v2), or a line-item field key with its position (`item_index`, #25; null for header fields; check `item_index is null or item_index >= 0`, #47) | internal |
 | `old_value`, `new_value` | text | value before / after; the newest row is the current value | confidential + personal |
 | `corrected_by`, `created_at` | uuid, timestamptz | who and when; no FK to `auth.user` (like `audit_events.actor_user_id`) – the history must survive a user's removal | personal (staff) |
 

src/db/migrations/0016_correction_item_index_check.sql

@@ -0,0 +1 @@
+ALTER TABLE "app"."field_corrections" ADD CONSTRAINT "field_corrections_item_index_check" CHECK (item_index is null or item_index >= 0);