Hard-deletes the account and everything on it, archived and restorable, with its identity links frozen as a tombstone so a re-sync cannot re-mint it.

Goes: contact edges (+ links, traits, relationship ownership), events, raw payloads, files, traits, identity links, member assignments, embedding chunks + conversations (derived — deleted, never archived), segment memberships (each preceded by an exit so Segment Sync consumers do not hold a member that no longer exists), and any human the delete leaves with no affiliation and no evidence anywhere.

Stays: file BLOBS (the archive references them; a permanent purge deletes them), /ask transcripts (detached — the conversation is the user's, not the record's), and the schema registry, segments and score definitions (config, not data). The unresolved pool is untouched; the tombstone guard fires at promotion time instead.

System events (entity.created, member.assigned, score.changed, …) die WITH the record: #419's rule protects the audit log of SURVIVING state, and here the state and its log leave together.