fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

tools/summarizer/app.py

@@ -175,6 +175,7 @@ if EAGER_MODEL_LOAD and not SKIP_MODEL_LOAD:
     _ensure_runtime_loaded()
 
 cache = TTLCache(maxsize=1024, ttl=60 * 60)
+cache_lock = threading.Lock()
 
 
 class SummarizeRequest(BaseModel):
@@ -959,8 +960,10 @@ async def summarize(req: SummarizeRequest):
         raise HTTPException(status_code=400, detail="min_length must be smaller than max_length.")
 
     key = _key(req.text, req.max_length, req.min_length, req.top_skills)
-    if key in cache:
-        return {"summary": cache[key], "cached": True}
+    with cache_lock:
+        cached_summary = cache.get(key)
+    if cached_summary is not None:
+        return {"summary": cached_summary, "cached": True}
 
     info = _role_focused_excerpt(req.text)
     summary = _model_summarize(info["focused_input"], req.max_length, req.min_length)
@@ -1028,10 +1031,19 @@ async def summarize(req: SummarizeRequest):
         lines.append("- Prepare examples showing relevant impact, collaboration, and delivery.")
 
     out = "\n".join(lines).strip()
-    cache[key] = out
+    with cache_lock:
+        cache[key] = out
     return {"summary": out, "cached": False}
 
 
+@app.delete("/maintenance/cache")
+async def purge_cache():
+    with cache_lock:
+        cleared = len(cache)
+        cache.clear()
+    return {"cleared": cleared}
+
+
 def _normalize_text(value: str) -> str:
     value = value.replace("\x00", " ")
     return re.sub(r"\s+", " ", value).strip()