# Data model completion audit — 2026-09-10

The `model` node previously described push persistence and account deletion as
unfinished. Those statements are obsolete. This audit compares its requirements
with the current SQL changelog, services and existing passing tests; it adds no
migration and changes no data.

| Requirement | Implemented evidence |
| --- | --- |
| Private accounts, email identity, invitations and revocable device logins | `app_user`, `email_identity`, `account_invitation`, `admission_control`, `device_login`; email/admission/device services use transactions and hashed proofs. |
| Work belongs to the owner's customer/project | Composite foreign keys in `work_project` and `work_entry`; `OwnerTransactions` locks the active owner while `WorkService` checks the daily total and record version. |
| Daily habits, historical bounds and days off | `habit`, `habit_day`, `habit_limit`, `day_off`, their unique keys and owner relations; HabitService handles Monday boundaries and hint-only limits. |
| Defaults applied once | `account_defaults` records per-owner initialization; catalog/preferences remain owner-bound. |
| Push subscriptions and retry state | A subscription references its device login; device/account validation and optimistic versions are enforced by PushSubscriptions. ReminderQueue persists per-subscription/date status, retries and leases. Device deletion cascades to subscriptions and deliveries. |
| Complete transactional account deletion | AccountDeletion consumes the fresh proof and deletes the private trail in one transaction. Spent invitation markers remain spent; deletion cascades cover identity, device, push and deletion-grant records. |
| Time and browser boundaries | Technical timestamps use UTC epoch seconds derived from Instant; business dates use SQL DATE/LocalDate and validated IANA ZoneId identifiers. Browser drafts are not stored in these server tables. |

Historical `oidc_identity` schema remains for compatibility with existing
database histories and is cleaned during account deletion. The active account
binding is `email_identity`; no external identity provider is needed.

Reviewed passing CI XML reports from the 2026-09-10 05:50–05:51 UTC run cover
AccountDeletion (5 tests), AccountDeletionProofs (7), DeviceLoginService (7),
WorkService (8), HabitService (12), CatalogService (6), and EmailAccounts (10),
all with zero failures/errors/skips. The existing local PushSubscriptions report
adds 15 passing tests including queue restart/retry and concurrent claim
behavior; AdmissionService adds three. The complete CI build for `13f6c25`
(0.1.86-SNAPSHOT) succeeded and deployed. The schema's last change was
`2833c48`, before these test runs.

H2 selection and jOOQ comparison remain documented in the persistence spike
and decision 0001. Real failed-migration rollback is covered by WJ-021, with
consecutive failures and failed recovery covered separately. These establish
the persistence implementation; physical Android/background push delivery and
restoration from Hostsharing's own backups remain open under their own nodes.