Deletion (terminal state): a type-it-exactly confirmation gate; every revival path refused.
Review hardening: terminal-state guards, mandatory audit trail on partial success, and a rollback safety stamp on failure paths (admin-side and self-service password changes share the same policy).
