docs(account): record step 3 (module hooks, kit re-pin) as built

ACCOUNT_DELETION.md: status line, and §6 step 3 marked built with what went beyond
§4.4 (Module-uo queues before calling, also retries on a live server.hello, clears
pending rows on a webId-less login, lists them via GET /admin/uo-link/config).
modules/uo/SCHEMA.md: the new shard_pending_unlinks table, and the table count
corrected (it was already stale: 33 tables, 32 shard_* plus uo_link_config).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/ACCOUNT_DELETION.md

@@ -1,8 +1,8 @@
 # Account deletion — a member deletes their own account, on the website and in the app
 
 **Status:** plan of record, 2026-10-29, with every question answered (AD4-AD13). **§6 step 2
-(core) built 2026-10-29** as website `feature/account-deletion`, `MODULE_API` 1.20.0; steps 3-6 are
-next. Each phase in §6 stops for the org lead before the next one starts.
+(core) built 2026-10-29** and merged as website#232 (`7bd93b8`), `MODULE_API` 1.20.0. **Step 3
+(modules and kit) built 2026-10-30**; steps 4-6 are next. Each phase in §6 stops for the org lead before the next one starts.
 
 **Why now.** Google Play's Data safety form asks whether the app lets people create an account, and
 an app that does must let them delete it, both **in the app** and at a **web address** given to Play
@@ -333,6 +333,23 @@ Asked while building core (§6 step 2), the same day:
 3. **Module-Rust** (`edge`) and **Module-uo**: §4.4's hooks plus their core-ref pins, one PR
    each. Module-uo's PR adds `shard_pending_unlinks`, the retry, and the *still linked on the
    shard* list. **Integration Kit**: the re-pin and the paragraph, one PR.
+   **Built 2026-10-30**, all three pinned to `7bd93b8` with `coreApi` `^1.20.0`:
+   - **Module-Rust** (`edge`): `links.unlinkForDeletion`, as §4.4 says.
+   - **Module-uo**: `utils/accountDeletion.js`. Beyond §4.4:
+     - every account is queued *before* the first sidecar call, because one call can outlast the
+       hook's 10 s;
+     - the retry also runs on every live `server.hello` (the plugin reconnecting to a sidecar that
+       stayed up);
+     - a `pending` row clears on a live login without the `webId`, as a `refused` one does;
+     - *still linked on the shard* is `pendingUnlinks` on `GET /admin/uo-link/config` and a section
+       on Admin → Shard, so there is no new route.
+
+     The table is in [`modules/uo/SCHEMA.md`](../modules/uo/SCHEMA.md).
+   - **Integration Kit**: chapter 2 also gained the demo's two unlisted refusals (multipart and
+     `data:` URIs), which it had never taught.
+   - **Checked:** each repo's tests, and both modules' frozen-manifest job reproduced against
+     `7bd93b8`.
+   - **Not walked:** the live deletions are step 6.
 4. **Android** (`edge`): §4.3. One PR.
 5. **runicgateway.com**: §4.5, plus `PLAY_DATA_SAFETY.md` regenerated. One PR.
 6. **A walk**, using a throwaway account on each surface: