GDPR right-to-be-forgotten — hard-deletes the profile and all related rows.

IDENTITY MUST BE PROVEN, NOT ASSERTED (architecture.html F1). This path is irreversible, so it fails closed: it deletes only for an identity the SERVER verified.

The service has no server-verified identity carrier: the site signs in through the Wix Members Area and Render never receives a token it can check. A caller-supplied member_id or session_id is not proof of ownership — normalize_member_id merely strips a "wix:" prefix and verifies nothing, and get_user_profile_by_identity matches on ('wix:' || member_id) and on session_id with no ownership check. Honouring them here would let an unauthenticated caller holding a (non-secret) Wix member GUID permanently destroy another member's profile and all related rows.

So this endpoint always answers auth_required — the same answer it has given in production since before the dead token path was removed (the old verifier could never succeed: its service-account env var is not set on Render). Erasure requests are served by the owner-gated manual path until a server-verifiable Wix member proof exists.

Scope note: the READ paths are deliberately left unchanged — they remain owner-gated under the 2026-06-20 "DOCUMENT ONLY, do not touch auth" ruling.