Mobile PR #733 and backend PR #497 implement this flow. The mobile replaces the inert account-deletion label with a confirmed irreversible request. The app waits for server acknowledgement before erasing credentials and private local records, then resets mounted collection state. Cancelling is harmless; failure remains visible and does not become a false success.

The account-deletion guide records the API contract, local erasure boundaries, subscription notice, disposable QA procedure and the separate retention/backup/restoration obligations. This is not the admin support console's reversible deleted status.

Mobile Verification

• npm run lint: zero issues; npm run typecheck: passed.
• Full Jest suite: 2,652 passed, 11 existing skips, 279 suites passed.
• Focused deletion/controller/mounted-boundary suites: 31 tests passed.
• Real in-process app collaborators verify credential/cache removal, HTTP failure preservation, other-owner scoped cache preservation and interrupted local cleanup. The actual installed React Native reconciler verifies private state unmount/reset. Native storage and the HTTP transport are replaced in these mobile tests; they are not PostgreSQL or native-device end-to-end evidence.
• Observed Red/Green cycles cover the missing deletion API, remaining private records, inert action, missing confirmation submission and unhandled rejection. The recovery fault-injection fixture initially hit an earlier mock delegation; that fixture error is not counted as behavioral Red evidence.
• Maestro flow added with explicit destructive QA opt-in. npm run e2e cannot run here because Maestro is not installed. Native iOS remains unverified.

Backend Verification

• API unit suite: 1,199 passed. Ingest unit suite: 553 passed. Production and test/script TypeScript checks passed.
• Disposable loopback PostgreSQL 16 suite: 38 passed, zero skipped. Tests cover the full private-FK cascade (including circular session/token references), physical avatar deletion, SQL/filesystem failures, other-owner preservation, and concurrent refresh/exchange, collection writes, avatar upload and email claim.
• Backend PR records observed Red/Green cycles, including real deadlocks before consistent lock ordering was added and successful tests afterwards.
• Full backend E2E attempted locally: 39 passed, 52 failed, 11 skipped because Docker, OCR traineddata and real scan indexes were unavailable. The final targeted PostgreSQL suite was rerun after the last code changes. CI remains the authoritative check for the complete provisioned integration environment.
• The backend CI run subsequently passed the complete API E2E job in its provisioned environment, alongside the unit/typecheck and ingest integration jobs. Compose smoke was still running at this observation; this does not claim a fully green run yet.
• A failed SQL commit after unlink can leave a surviving account without its avatar; retry tolerates an absent file. No success is returned on a known error.

Rollout Status

Both application changes target staging through separate PRs. No merge, deployment, production account deletion, database migration or emulator reset is part of implementation validation. The backend endpoint must be deployed before distributing the mobile change. App Store approval and complete privacy/legal compliance are not asserted by these checks.

Staging Reconciliation (2026-10-19)

Backend #507 and mobile #742 extend the already integrated #497/#733 flow: mailbox proof, typed confirmation, stable retry receipts and recovery after lost replies or interrupted native cleanup. The guide now describes the current POST contract while retaining the legacy DELETE endpoint for existing clients. Current password login/change, root revocation at sign-out, pricing and catalogue changes are retained. Legacy confirmed-cleanup markers are migrated without another server deletion. An explicit displayed-owner guard prevents a queued stale confirmation from targeting an account adopted in the meantime.

Local reconciliation checks: mobile lint/typecheck pass, 2,754 Jest tests pass with 11 existing skips; ingest has 553 passes. The complete API suite has 1,313 passes and nine optional skips. The focused backend erasure suite has 16 passes including the real sequential PGlite SQL case, now covering the password table cascade as well as sessions, holdings, account isolation and safe retry after email reuse. PGlite is external validation tooling, not a new application dependency or proof of PostgreSQL 16 concurrent locking.

The mobile 11-file scope exception was explicitly approved to retain collection boundary coverage. Maestro is not installed and the local Docker daemon is unavailable; native/destructive E2E and full provisioned scan E2E are not claimed. The attempted full backend E2E run reports three passes, 93 failures and 11 skips with the local database, OCR data and real scan indexes unavailable. GitHub Actions jobs are refused before execution because of organization billing/spending limits. The user explicitly requested proceeding without paid Actions; no billing, protection or workflow setting is changed. This delivery merges sources only: no VPS migration, deployment or account erasure is performed.