[lilyshen0722]

Flips backend.env.syntheticAccountPurge to "true" in values-dev. That's the one-line follow-up #2219 promised, gated against its posted dry run (see the #2219 comment): one account examined, only its own footprint counted, one unprefixed seat skipped as designed.

After the deploy, the scheduler runs the purge at 02:47 and 14:47 UTC.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AoU48YDZy3VZtQ55ZyCwjg

[lilyshen0722]

Gate at bfcb624 (eng lead), against the operator dry run posted on #2219 (production, 8987ec6, 15:43Z, flag false). I read the JSON itself, not the summary.

• Examined: 1 account, eng-smoke-journey-1015124709, which matches the username pattern. The in-cluster runs' accounts are under the 2 h minimum.
• Would delete only that account's own footprint:
  • its user row and its per-user Scout (scout-u15d0363247, derived from that account's id), each in Mongo and Postgres (2 + 2);
  • that Scout's memory (1) and events (4);
  • the account's 1 approval, 1 attention item and 1 first-message mark;
  • nothing in pod.members or pg.pod_members, and pods: [] (the journey had already deleted its pod).
• Skipped: seat engsmoke-claude, "name lacks the journey prefix". Guard (a) worked as designed. Such seats accumulate as reported skips until TASK-259 makes the suggester derive the seat from the username; that's a cosmetic leftover, not a safety gap.

The diff is the one-line flip in values-dev, with a comment saying how to pause it. The scheduler registers the job only for exactly "true". The first apply runs at the next 02:47 or 14:47 UTC after a deploy carries this.

GATE: PASS

[lilyshen0722]

First apply, 2026-10-16 02:47Z, on backend 520d3d28 (rolled out 02:34Z; SYNTHETIC_ACCOUNT_PURGE=true confirmed in the pod):

[synthetic-purge] accounts=9 refused=0 counts={"agentmemories":6,"agentevents":32,"pg.users":18,"users":18,"approvalactions":8,"attentionitems":6,"summaries":0,"onboardingsilenceepisodes":0,"podmemberfirstmessages":9,"pod.members":0,"pg.pod_members":0,"agentinstallations":0,"agentregistries":2}

No refused or failed line. Compared with the one-account dry run:

• users 18 / pg.users 18: each of the 9 accounts plus its Scout bot, 2 per account, as in the dry run.
• podmemberfirstmessages 9: 1 per account, as in the dry run.
• agentmemories 6, attentionitems 6, approvalactions 8: up to 1 per account. Not every run leaves a Scout memory or an attention item.
• No pods key: none of the 9 created a pod (no failed mid-pod runs).
• agentregistries 2: ephemeral seat rows whose names carry the eng-smoke-journey- prefix, with no installation and no bot user (hence agentinstallations 0 and no extra users).

Idempotent: re-running the dry run (--min-age-hours 2) gives examined: 0. With --min-age-hours 0 it finds 3 journey accounts under 2 h old (01:46Z, 02:17Z and the 02:34Z post-deploy run); they go at 14:47Z.

Residual, not handled: the seat the dry run skipped (engsmoke-claude, name lacks the prefix) is still in agentregistries, ephemeral, with 0 installations and no bot user. Its publisher account is now deleted, so the row is an orphan holding that name. The skip worked as designed; the orphan is a consequence of deleting the account anyway. Journey seats created today carry the prefix (eng-smoke-journey-10-…), so this should not recur. Options: delete this one row by hand, or have the purge refuse an account that has a skipped seat. Undecided.

Other eng-smoke-* accounts (authz, firstopen, hosted, hosted2) are outside the purge's username pattern and were left alone, as intended.

[lilyshen0722]

Orphaned seat rows: guarded one-off, 2026-10-16 (CTO ruling; the code fix that prevents new ones is #2255).

Before: 384 ephemeral registry rows. 2 were orphaned, meaning their publisher account no longer exists:

agentName	created	installations	bot users with that name
engsmoke-claude	2026-10-15	0	0
smoke-createpod-agent	2026-08-06	0	1

Run: one script, both ids. For each, it re-read the row as { _id, ephemeral: true } and re-checked three conditions: publisher missing, 0 installations, 0 bot users with the agentName. It deleted with deleteOne({ _id, ephemeral: true }) only if all three held. Each row was saved locally before any delete.

• engsmoke-claude: all three checks passed, deleted (deletedCount: 1), row gone.
• smoke-createpod-agent: skipped, because the bot-user check failed. Its bot user (…@agents.commonly.local, created a second after the row on 08-06) is the seat's own identity. It is in 0 pods and has 0 memory rows. Deleting the registry row alone would free the name with the old bot still attached, which is the name-reuse hazard in TASK-270, so the row stays until someone decides about the bot as well.

After: 383 ephemeral rows, 1 orphaned (smoke-createpod-agent, held as above).