feat(ai): add safe benchmark harness

docs/verification/sec-009-account-lifecycle.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-15
 
-Status: `IN PROGRESS`. Generated-output ownership and the readable export are implemented. The disabled deletion lifecycle remains to be implemented.
+Status: `IMPLEMENTED — NOT VERIFIED`. Generated-output ownership, readable export, and the dark-launched deletion lifecycle are implemented and locally verified. Production activation remains blocked by retention and restore policy.
 
 ## Owner inventory boundary
 
@@ -29,22 +29,35 @@ No existing generated file is moved or guessed. Legacy shared-date outputs stay
 - The Settings Backup tab presents the readable export separately from the application-key-encrypted operational backup and explains recent sign-in without weakening the API rule.
 - Temporary ZIPs live under an opaque owner root and are opened with delete-on-close when returned by the controller.
 
+## Checkpoint 3 — disabled, retryable deletion lifecycle
+
+- Additive Identity status plus durable request/file-ledger tables track request, stage, retry, file checksum, row count, warnings, and sanitized failure state. SQLite is EF-generated; the MariaDB migration uses explicit bounded types and its generated script was reviewed.
+- `AccountLifecycle:DeletionEnabled` is explicitly `false` by default. Both self-service and admin requests fail safely while disabled; the old admin Identity-only delete path has been removed.
+- A valid request immediately marks the account pending, rotates its security stamp, revokes sessions and trusted devices, unpublishes public CVs, cancels queued work, and requests cancellation of running work. Pending users cannot sign in, complete 2FA, or reuse an existing local session.
+- Self-service requires an exact server-provided `DELETE <email>` phrase and a session created within 15 minutes. Last-administrator protection remains enforced. Admin deletion uses the same coordinator and exact-email confirmation header.
+- One managed-root inventory covers attachments, CV artifacts, file-backed avatars, generated CVs, daily exports, and previously generated account-export ZIPs. Files move to same-volume quarantine markers before any database delete; partial file failure restores them and leaves rows untouched.
+- Database deletion is explicit and transactional across all owned application, Career, CV, correspondence, provider-credential, queue/notification, security, and Identity rows. Request/file ledgers survive for retry and audit. Commit-acknowledgement ambiguity leaves files quarantined and replays deletion instead of risking data resurrection.
+- Purge clears backend in-memory caches, removes quarantined files, then writes a minimal pseudonymous tombstone to a separate append-only JSONL root. Invalid ledger records fail closed.
+- Startup stages restored identities matching tombstones before readiness, and the background reconciler resumes all durable non-completed requests even while new deletion requests remain disabled.
+- Settings explains the disabled production gate; when enabled it uses the reusable prompt dialog and exact phrase. Admin user deletion supplies the matching account email.
+
 ## Verification
 
 - Owner-storage focused CV/export/controller/background tests: 77/77.
-- Readable-export focused backend/API tests: 11/11, including real SQLite, two-owner isolation, file inclusion, every checksum and secret-redaction sentinels.
-- Full backend: 650/650.
-- Frontend export/Settings tests: 4/4; full frontend 58 suites/234 tests.
+- Account lifecycle/export/auth/admin focused backend/API tests: 21/21. Five real-SQLite deletion tests cover disabled requests, exact confirmation/recent authentication, immediate lockout/idempotency, two-owner row/file isolation, quarantine failure, repeat reconciliation, tombstone creation, and restored-backup replay.
+- Full backend: 657/657.
+- Frontend export/Settings/admin tests: 8/8; full frontend 58 suites/237 tests.
 - Backend build: pass, zero warnings/errors.
 - Optimized frontend build/TypeScript: pass.
-- Chromium: fresh Free account receives a real ZIP response with a `PK` signature and readable-export success state.
+- EF model parity: no pending model changes. MariaDB migration script generation: pass with bounded Identity/lifecycle schema and indexes.
+- Chromium: full disposable startup/application suite 9/9; fresh Free account receives a real ZIP response with a `PK` signature and readable-export success state.
 - `git diff --check`: pass aside from line-ending notices.
 
-## Remaining repository work
+## Remaining external/production work
 
-1. Reuse the completed owner inventory in the deletion coordinator.
-2. Add the additive deletion state/request/file schema and disabled coordinator.
-3. Add pending-account authentication/mutation gates, session/queue cancellation, provider cleanup and idempotent file quarantine/database purge.
-4. Add separate tombstone storage/replay and settings/admin UX while keeping production activation disabled.
+1. Decide backup, audit/security-log, quarantine, and tombstone retention plus any legal-hold obligations.
+2. Mount/protect the tombstone root outside restored application data and rehearse a pre-deletion backup restore with tombstone replay.
+3. Rehearse sidecar cache purge/restart and remote provider-revocation semantics using a disposable synthetic account.
+4. Only then enable admin deletion, observe it, and separately approve self-service activation.
 
 Production retention, legal hold and restored-backup decisions remain recorded in `BLOCKERS.md`.