Backend PR: https://github.com/snag-tcg/tcg-collector-backend/pull/517

Implemented In The Source PR

The existing maintenance CLI gains --login-code-days. It selects only expired email verification rows whose issuance is also older than the explicit cutoff. Simulation is the default. Apply locks at most the requested batch with FOR UPDATE SKIP LOCKED, rechecks age/freshness and returns counts only. It does not erase users, passwords or sessions and does not duplicate the existing startup/hourly password-throttle sweep. Proposed cadence is hourly with one day after code expiry, subject to reviewed activation rather than a legal promise.

Test-first cycles reproduced missing simulation, apply and CLI behavior. The focused suite passes 15 tests. API unit tests pass 1314 with 11 skipped; ingest passes 553. API build, JavaScript-layer typecheck and whitespace checks pass. Local real PostgreSQL E2E is blocked because the Docker Linux engine is unavailable. The existing CI E2E fixture was extended for live/cutoff/reissued and consumed codes, bounded repeat deletion and another transaction's lock/renewal. CI must establish that integration evidence; it is not claimed as locally green.

At the original validation, CI activation was blocked independently of the patch: all six jobs on run 39299740871 were rejected before any steps started. GitHub's annotation reports an account-payment or spending-limit problem. No workflow permissions, assertions or billing settings were changed to bypass it. The backend PR was then draft; that describes the original validation, not its current repository status.

On 2026-10-21, GitHub confirms backend #517 merged into staging on 2026-10-20. That merge does not establish a production deployment, completed recovery drill, activated retention schedule or successful hosted integration run. The external activation gates below remain open until independently verified.

Operations Proposal And Open Gates

The source PR includes Privacy And Recovery Activation Plan, covering legal/support access, the retention matrix, independently encrypted offsite Restic recovery sets, matching PostgreSQL/private-file snapshots, alert delivery and an isolated restore rehearsal. Initial RPO 24h/RTO 4h are proposed targets requiring approval and measurement, not guarantees.

Important recovery gap: account_deletions holds retry/file-cleanup receipts without a stable user ID and expires completed receipts after seven days. It is not a recoverable erasure ledger for thirty-day backups. A separately reviewed durable minimal ledger/outbox and migration are required before promising that restoring an old backup cannot resurrect deleted accounts. Its identifiers remain personal/pseudonymous data and need their own justified access/expiry policy.

No purge, service change, backup installation, storage account, notification, erasure-ledger migration or production deployment was performed. Company identity, final legal content, a monitored support/rights address, alert recipients, approved offsite storage and recovery-key ownership remain external inputs. No secrets, private VPS coordinates or user contents are in this entry.

Read-only Observations On 19 October

• Public health/readiness return success; diagnostic auto-archive and production diagnostic opt-in are disabled; account-linked scan statistics remain enabled.
• No application backup/retention timer was identified in the inspected scope.
• Grafana is reachable but has zero alert rules; email receiver configuration does not establish successful delivery. The private admin gateway is unhealthy while the public API responds.
• Raw API/proxy/ingress loggers have no per-container rotation options. Loki's shorter seven-day window does not establish expiry of those originals.
• Legal pages remain placeholders and mobile help/legal destinations need wiring to approved content, not another placeholder link.

These are scoped observations, not proof of absence of external monitors, provider snapshots or independent backup copies. Separate account-erasure source PRs backend 507/mobile 733 have merged; distributed and deployed versions still need their own disposable-account acceptance evidence.