The backend and mobile branches implement owner-confirmed permanent account erasure. Linked accounts prove mailbox access; anonymous and blocked accounts can also erase themselves. The database transaction removes the user and account-owned records through existing cascades, clears recovery/waitlist data and durably queues private-avatar cleanup. A receipt containing only credential and operation hashes permits safe retry after token erasure. Completed receipts expire after seven days; pending avatar cleanup remains retryable.

Mobile confirmation warns about irreversibility and separate store subscription cancellation. After server success it clears the current owner's local private stores, queued scans and native credentials, while preserving other owners' scoped holdings. Encrypted pending state and a non-secret final-cleanup marker survive network loss or a partial Keychain reset. Account use is blocked during uncertain deletion; Account reopens the recovery action. Queued ownership writes and late sync responses cannot restore the erased inventory, and mounted private screens reset after success.

Deploy additive migration 0044_account_deletions.sql and the API before the mobile build. This work performs no production migration or user erasure. It does not certify backup expiry/restoration procedures, erasure of another phone's offline cache, provider-log retention or Google's separate Web deletion resource. See backend docs/BACKEND.md and the mobile changelog for the full contract and validation limits.

Related mobile issue: 741.

Delivery PRs: backend 507 and mobile 742. Both target staging; no merge, deployment or native rebuild is claimed.

Local validation: mobile ESLint and TypeScript passed; Jest passed 2,668 tests with 11 existing skips. API passed 1,225 tests with the optional SQL integration skipped in the default run; API build/checkjs and 553 ingest tests passed. The focused external-PGlite run passed all 16 tests, including real SQL. The mobile pre-push hooks also passed. Maestro is not installed and Docker Desktop cannot start, so native E2E and Docker-backed PG16 checks remain unverified. The docs build passed. Tracking-index regeneration is blocked by a pre-existing type: fix entry in tracking/features/2026-10-18-onepiece-preview-verification.md; this feature does not alter that unrelated entry.