feat(ai): add safe benchmark harness

BLOCKERS.md

@@ -29,18 +29,18 @@ Updated: 2026-08-15
 ## Production verification and deployment
 
 - **Blocked:** Authenticated production smoke tests, backup restore verification against real data, OAuth-provider checks, and deployment.
-- **Why:** These require production access, real credentials, and operator authorization.
+- **Why:** Read-only host access is available, but authenticated smoke, port/network closure, complete backup restore, provider checks and deployment require credentials and/or operator-authorized production mutations.
 - **Required:** After the current pull request passes CI and is approved, follow `docs/release-candidate-review.md` and `docs/release-checklist.md` on the production host. Confirm the admin-only version badge matches the deployed commit, then run the authenticated application workspace, Career, CV, attachment, email-verification and rollback checks.
 - **Recommended:** Verify backup/restore before deployment, then exercise login, existing application counts, Career Workspace, public CV refresh/download, AI, and attachments in order.
-- **Current access check:** Read-only SSH access is confirmed to the LAN production host as both `root` and `pi` using the existing `id_ed25519` identity. All four containers are healthy and the host has 44 GB free. No production change or deployment was attempted.
-- **Current status:** Anonymous production checks confirm the frontend and `/api/auth/config` return HTTP 200. The public `/health` path currently returns the SPA HTML shell; the release branch proxies that exact path to the backend and includes a regression test. Gitea PR 28 exists and an earlier complete PR gate passed; the newest local checkpoint still needs its remote CI run after push. The current local release matrix passes, including Chromium 9/9. React Router is now 7.18.2 and the recorded local dependency audit is clean, so the superseded router/runner blockers were removed.
+- **Current access check:** Read-only SSH access is confirmed. All four JobTracker containers are healthy with zero observed restarts, but root free space is now 36 GiB (83% used). The production checkout is at `de937d25dc5e` / app version `157` and has an unreviewed mode-only change to `deploy/deploy.sh`. No production change or deployment was attempted.
+- **Current status:** PR 28 now includes SEC-009 commit `842e793`; current remote CI still needs confirmation. The local release matrix passes (backend 657/657, frontend 237/237, build and Chromium 9/9). Read-only PROD-001 inventory found the JobTracker Ollama and frontend published on all host interfaces, the newest gzip-valid MariaDB backup dated 2026-08-02, no observed scheduled JobTracker backup, and no owner-file/key/tombstone recovery bundle. Close these rollout gates before deployment; see `docs/production/production-ai-hardware-assessment.md`.
 
 ## Account deletion retention and restore policy
 
 - **Blocked:** Enabling SEC-009 self-service deletion in production and declaring backup erasure complete.
-- **Why:** Repository code can implement a readable export and idempotent live-data deletion behind a disabled gate, but it cannot truthfully choose legal retention periods, backup expiry, provider obligations or the tombstone lifetime needed to prevent restoration from resurrecting an erased account.
+- **Why:** The readable export and idempotent live-data deletion coordinator are implemented at `842e793` behind an explicit disabled gate. Repository code cannot truthfully choose legal retention periods, backup expiry, provider obligations or the tombstone lifetime needed to prevent restoration from resurrecting an erased account. Production inventory also confirms current backups are database-only and no protected tombstone volume exists yet.
 - **Required:** Decide retention periods for operational backups, audit/security records and deletion tombstones; identify any legal hold/export obligations; approve the restore behavior for deleted identities.
-- **Recommended:** Keep production self-service deletion disabled until a restored-backup rehearsal proves that tombstones suppress resurrection. Continue repository export/deletion implementation with explicit retention metadata and no automatic backup deletion.
+- **Recommended:** Keep production self-service and admin deletion disabled. Decide retention, mount the tombstone store outside restored application data, build a complete DB/files/keys backup set, then use a disposable account to prove provider/cache cleanup and restored-backup tombstone replay before staged activation.
 
 ## Legacy job/application column cutover