fix: cap account deletion grace at 30 days

[thomasluizon]

DEGRADED: same-vendor review

Summary

• Adds a 30-day maximum deletion grace constant.
• Clamps the existing paid-through deletion candidate while preserving shorter extensions and the seven-day default.
• Covers long-term Pro, short-term Pro, the exact cap boundary, Free, trial, expired-plan, and invalid-code behavior.

Scope

• API only, limited to the three files named by ORB-97.
• No migration, social-table, entity, contract, or mobile changes.

Validation

• The long-term Pro regression test failed before implementation with a 347-day result against the 30-day ceiling.
• dotnet build Orbit.slnx passed with 0 errors.
• The focused handler suite passed 15 tests.
• The analyzer suite passed 32 tests.
• dotnet test passed 5,599 tests across all suites.

Work item

ORB-97

[thomasluizon]

Approach

I will add MaxDeletionGraceDays to AppConstants, compute the existing deletion candidate in ConfirmAccountDeletionCommandHandler, and clamp that candidate to the 30-day ceiling. I will extend ConfirmAccountDeletionCommandHandlerTests with the requested Pro, boundary, Free, trial, expired-plan, and invalid-code cases, first proving the long-term Pro case fails before changing production code.

This keeps the rule at the command that owns deletion scheduling. Putting the clamp in User.Deactivate would silently change other callers, while removing the paid-through branch belongs to ORB-109. No entity, database, migration, social-table, contract, or mobile change is needed.

[thomasluizon]

DEGRADED: same-vendor review

The known same-vendor bias direction is toward more favorable judgments; its magnitude here is unmeasured.

Head: cd6c560f561223db0005d21d4ef7fb6458999b1a
Verdict: CLEAN

APPROVED BY PR-REVIEW: zero blocking findings

Findings and follow-ups:

• Blocking findings: none
• Non-blocking findings: none
• Linear follow-ups: none

Coverage:

• PASS: Correctness; dead and stale code; SOLID and clean architecture; comment policy; no-workaround and root-cause; type safety; no console.log; security; backend hard rules.
• All three changed files received a clean verdict.
• The gated security specialist pass is clean. A tentative domain-guard concern was rejected because ORB-97 explicitly excludes entity changes and the command handler is the only production caller of User.Deactivate.

N/A dimensions:

• DESIGN.md and AI-slop: no apps UI files changed.
• Parity: API-only diff with no frontend mirror surface.
• i18n: no user-facing strings or locale files changed.
• Contract drift and backward compatibility: no DTO, controller route, endpoint, schema, field, enum, or response type changed.
• FEATURES.md parity: no user-facing feature inventory change.
• Contract aligner: its DTO, route, shared-type, and endpoint gate did not fire.
• Adversarial blocking-finding verification: no Critical or High finding survived.
• Independent build and test: the primary checkout is main at 4d2050a2bc705681f477a73818007e2de3c4cc6d, not the frozen PR head, and this review order forbids a worktree or checkout mutation. The frozen PR body reports dotnet build Orbit.slnx with 0 errors and dotnet test with 5,599 passing tests.

[thomasluizon]

DEGRADED: same-vendor review

Same-vendor bias direction is known, but its magnitude in this review is unmeasured.

APPROVED BY PR-REVIEW: zero blocking findings

• Issue: ORB-97
• PR: fix: cap account deletion grace at 30 days #461
• Frozen head: cd6c560f561223db0005d21d4ef7fb6458999b1a
• Round: fresh round 1
• Blocking findings: none
• Non-blocking findings: none
• Follow-ups: none

Dimension results:

1. Correctness: clear. The paid-through candidate is preserved below the ceiling and clamped at 30 days above it. The specified Free, trial, expired-plan, boundary, and invalid-code cases are covered.
2. Dead / stale code: clear. The new constant is used and the diff orphans no code.
3. SOLID / clean architecture: clear. The change remains in the existing command handler and shared constants surface without adding unnecessary indirection.
4. No-workaround / root cause: clear. The server-side scheduling rule is corrected at its source.
5. Test quality: clear. The tests assert externally visible handler results against independent expected dates, and the long-term Pro case would fail without the clamp.
6. Security: N/A. The diff adds no endpoint, authorization boundary, webhook, key, session, logging, rate-limit, or input-validation surface.
7. Contract alignment and backward compatibility: N/A. No route, method, DTO field, schema, or requiredness changes; the bounded date semantics are the ticketed correction reviewed under correctness.
8. Cross-platform parity: N/A. Backend-only diff with no consumer change required.
9. i18n: N/A. No user-facing string is added or changed.
10. Design: N/A. No UI file is touched.
11. Backend hard rules: clear. No user-local date, validator placement, result-flow, swallowed-error, or missing-unit-test issue is introduced.
12. FEATURES.md gating: N/A. This bug fix adds no screen, route, tab, tool, plan gate, platform availability, or locale-specific behavior.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud