The parts that matter when you have real users and data.
Account and workspace deletion default to scheduled + reversible. There is a grace window and a full-screen cancel gate. Immediate erasure (GDPR Art. 17) is a separate opt-in path using the confirm-actions email token.
Jobs are idempotent. Handlers always check current state before mutating. The worker is protected by CRON_SECRET.
The reflective registry (orgScopedTables + member FK columns) drives both exports and the cascade on hard delete. If you add a new org-scoped table, register it.