[bokelley]

The self-service and administrative organization-deletion routes now return the generic 503 organization_deletion_unavailable response before route authentication or identity hydration, provider calls, billing reads, and deletion work. Their authorization observer is excluded so the response cannot trigger provider reads afterward. Global parsing and CSRF behavior remain in place.

Mounted tests cover credentials, linked identities, roles, selectors, replay, observer behavior, and unchanged PostgreSQL state. The containment document records the remaining limitations and the durable lifecycle requirements for re-enabling deletion.

This eight-file change preserves the membership and authorization correction landed in #7538. Merge and operator bypass containment remains the separate follow-on in #7561. No deletion journal, reconciliation implementation, or rollback guarantee is added.

The document now includes a unique description and AdCP-prefixed og:title, fixing the SEO failure on the first published candidate. These five frontmatter lines are the only addition to the original #7560 delta: the containment source, tests, and document body remain unchanged. The document is therefore no longer byte-identical to the original #7560 blob.

Validation on the amended candidate:

• SEO: all 378 pages have both required fields, with zero errors and no new warnings on the containment document.
• 587 focused unit/integration tests across 17 files, using a fresh isolated local PostgreSQL database.
• Fresh ordinary migrations and an idempotent repeat; both typechecks; repository migration, schema-link, navigation, changeset-scope, title, and whitespace checks.
• All five repository Semgrep security rules on the three changed production files, with zero findings or scan errors.
• Full unmodified pre-commit hook: 1,063 root tests passed; 10,748 server tests passed, with 31 existing skips; both typechecks passed. Full unmodified pre-push hook passed.

Candidate commit: 95f9e0f22bfa24650b3ec805b3150213439cae42
Sole parent: 9d247db2e6e2af755951cba268b060425f246e2f
Reviewed tree: 8cfdad362eab77f39ece3e515f18be647d40f88c

[aao-secretariat]

Ladon verdict: Approve

Approve — clean defensive containment slice for #6827.

Both organization-deletion entry points (self-service DELETE /api/organizations/:orgId and admin DELETE /api/admin/accounts/:orgId) now return an unconditional 503 organization_deletion_unavailable before authentication, authority resolution, billing/provider reads, audit writes, and cascades, with the authorization observer correctly excluded. Reviewer verified return-before-auth (per-route guards removed, no dangling imports), effect-free proof in the 299-line integration test, app-only scope (no protocol surface, no changeset required or present), and the merge-path writer as genuinely pre-existing.

No blocking, High, or Medium code defects. Two documented non-blocking follow-ups noted (503-driven 5xx dashboard inflation, stale admin-UI delete copy) — neither actionable here.

Decision path: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high-risk reasons are (modified) not (deleted) (row 3 n/a); no medium findings at all (rows 4/5/8 n/a); no prior decision (row 6 n/a); no author team gate (row 7 n/a). The high_risk flag is a heuristic on modified server/src/routes/** files with zero medium-or-higher concerns, so the modification is presumed safe. Falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking or medium findings.

This PR is a patch-identical restack of a previously clean-approved tree (prior decision: approve). Both DELETE org-deletion handlers (organizations.ts:503, accounts-billing.ts:362) now return an unconditional 503 before any auth/authority/billing/provider/audit work, with the observer exclusion applied. Route matching is not broadened and no org data reaches the wire. Mounted Postgres integration and unit suites confirm zero DB/provider/audit/cache/notification effect across sibling substitution, all roles, platform admin, selectors, subscription states, replay, and CSRF ordering.

No protocol surface (static/schemas/source/, docs/reference/, dist/**), changeset, or dist artifact is touched — this is an operational/app change, so changeset, schema↔docs, oneOf, and immutability gates do not apply. The only operational cost (503 inflating /api 5xx metrics) is documented with mitigation.

Decision-table walk: no critical/high (row 1 no), gated_paths false (row 2 no), no deletions in high-risk reasons — both are (modified) (row 3 no), no medium findings (rows 4/5/8 no), prior decision was approve not escalate (row 6 no), no no-auto-approve team match (row 7 no). Falls through to row 9 → approve. high_risk is true only via (modified) route files with zero medium-or-higher findings, so the modifications are presumed safe per the high-risk-flag guidance. review_decision is APPROVED.

The base branch was changed.

[aao-secretariat]

Ladon verdict: Approve

Approve — metadata-only follow-up to a previously clean approval.

The only change since the prior clean approve (head 468adfa) is three frontmatter lines added to docs/contributing/organization-deletion-containment.md (description + AdCP-prefixed og:title) to satisfy the SEO gate. Naming is correct ("AdCP"), and no wire/schema/changeset/normative reference surface is touched — this is a contributing doc, not docs/reference/** or static/schemas/source/**. The containment code and test suites are identical to the prior approved candidate.

Checks applied:

• No critical/high/medium findings this run (rows 1, 4, 8 do not fire).
• gated_paths: false (row 2 does not fire).
• high_risk is true only via server/src/routes/** files that are (modified) but carry no findings — under the flag-reading rules a modified high-risk file with no medium-or-higher concern is presumed safe; rows 3 and 5 require a deletion or a medium finding respectively, neither present.
• Prior decision was approve, so sticky escalation (row 6) does not apply.
• No no-auto-approve team match (row 7 does not fire).

None of rows 1–8 fire, so the outcome is row 9: approve.