-- #160 follow-up. The first fix (2026-10-16 migration) cleared rows whose
-- legacy `date_taken_source` was 'filename'. But the true-instant drain
-- (#118) re-ran the resolver over rows with a correct legacy date (e.g. an
-- exiftool container date) and wrote only the new-contract triple, so
-- some rows carry a filename-derived implausible year in `date_utc` while
-- their legacy pair says 'exiftool'. On prod: three VID_<counter> videos
-- (years 2095, 2229, 8580) whose containers say 2016/2017.
--
-- Clear just the triple on any row whose true instant is outside
-- [1995-01-01, 2028-01-01) UTC. `date_utc IS NULL` puts it back in
-- `backfill_utc_dates`, which re-resolves it with the gated matcher; the
-- legacy pair is left alone (it's frozen for rollback, and here correct).
UPDATE image_exif
SET date_utc = NULL,
    camera_offset_minutes = NULL,
    date_taken_tz_source = NULL
WHERE date_utc < 788918400 OR date_utc >= 1830297600;