ACCOUNT_DELETION.md step 6: W1 (Module-Rust#71), W2 (Module-uo#48) and W3
(Rust-Plugins#47) move from "not fixed" to fixed. modules/rust/PLAN.md 29.8:
Carbon 2.0.262 no longer answers "user not found" for a never-seen Steam id;
it writes the grant or membership into one shared blank record held by every
never-seen id. The bridge now checks for a record first on Carbon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Every row of ACCOUNT_DELETION.md §6 step 6 walked on 2026-10-30 against
website 7bd93b8 with Module-Rust edge on the Carbon rig and Module-uo main
with the local ServUO and a uo-link sidecar: web and app deletions, the other
device's session, the Rust grant leaving the rig, the UO link cleared with and
without the sidecar, the forum's two views, the reserved staff name, the demo
and the last admin. Three findings left unfixed (W1-W3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 4 gains what was built beyond §4.3 (refusals
read off the body, the trust token dropped, the snackbar notice, the push
opt-in kept) and what was checked on the emulator. android/PLAN.md M8 step 3
notes the app's part is built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md: status line, and §6 step 3 marked built with what went beyond
§4.4 (Module-uo queues before calling, also retries on a live server.hello, clears
pending rows on a webId-less login, lists them via GET /admin/uo-link/config).
modules/uo/SCHEMA.md: the new shard_pending_unlinks table, and the table count
corrected (it was already stale: 33 tables, 32 shard_* plus uo_link_config).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 2 is built (website feature/account-deletion).
- MODULE_API.md: 1.20.0, api.onUserDeleting (§1.1, §1.1 history, §2.4).
- BACKEND_DESIGN.md: reserved_usernames, DELETE /auth/me/account, the admin
delete now running the same procedure, the demo lock row, and §6.6 on the
procedure, the display rule and what goes and what stays.
- TEAMS.md: the forum's deleted-author rule is now "[deleted player]" for
members and the stored name, marked, for staff.
- ACCOUNT_DELETION.md: AD12 (wrong password or code is 400, not 401) and
AD13 (a deleted account drops off Forum guests), both asked of the org
lead while building; §4.1 refusals carry codes; step 2 marked built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
A cascade is not an unlink. For UO the link lives on the shard (the
site's shard_account_links is a mirror), so dropping the mirror alone
would leave the shard attributing the game account to a deleted user.
- AD10: the hook is onUserDeleting and runs before the delete; each
module calls its own unlink for every link (Rust: links.unlinkOwned;
UO: the sidecar's DELETE /link/{account}, as the staff unlink does).
- AD11: an unlink that can't finish never holds up the deletion. A shard
that is offline queues into shard_pending_unlinks, retried on
reconnect. A protected staff account (403) is listed for admins as
"still linked on the shard".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The org lead answered the plan's six questions on 2026-10-29:
- delete at once, no grace period
- what a member wrote stays, and members see every snapshot of a
deleted account as "[deleted player]"
- staff keep the name and the IP for moderation, so the stored rows are
untouched and the rule is about who sees what (displayAuthor)
- the password is always the proof; SSO sits on top of a real account
- a UO game account stays on the shard; no protocol change
- a deleted staff username is never available again (reserved_usernames)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md is the plan of record for the org lead's decision:
a member deletes their own account on the website and in the app, as
Google Play requires of an app that starts accounts.
- One deletion service for the admin route and the member's own route,
with a confirm step, the last-admin and demo refusals, clearing the
username snapshots on what the member wrote, and a notice by email.
- MODULE_API 1.20.0: api.onUserDeleted, which runs after the commit and
can't stop a deletion.
- Screens on the web and in the app; runicgateway.com /delete-account/
as the address Play is given.
- What the schema already does (59 keys: credentials cascade, content
detaches), the gaps, six questions, and the build order.
M8's order puts account deletion before report, block and hide, which
moves USER_SAFETY.md's reportTargets to MODULE_API 1.21.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
