Integrate member profiles and Slack state with privacy export and full erasure

Parent epic: #108
Global privacy implementation: #64
Owner privacy decision: #23 (closed/approved)

Raw outcome

Integrate accounts-owned MemberProfile, SlackAccessGrant, legacy compatibility projections, and queued/delivery state into #64's account access/export, correction, full-erasure, retention, processor propagation, and restore-tombstone workflow. The member-domain adapter must expose all owned data and erase personal fields/future Slack eligibility without leaking the shared Slack secret or silently rewriting separately retained course history.

This is an accounts/email domain adapter into #64, not a second global privacy inventory, generic rights intake engine, or tombstone scheduler.

Dependencies and boundaries

Interface acceptance gate

PM may groom the bounded backend adapter only after these implementation-facing contracts are accepted, integrated, and identified by exact merge SHA/schema version:

• #254: canonical privacy authority/register version, required-domain manifest entry, field/right dispositions, retention classes, safe policy/block/exception codes, and unresolved HUMAN states.
• #255: privacy-request aggregate, domain-adapter registration, domain-work lifecycle, idempotency/revision, safe DTO/error, transaction, and durable-job boundary.
• #256: portable-export and correction adapter protocols, envelope/part schemas, artifact lifecycle seam, and safe result contract.
• #257: retention definition/runner/checkpoint/result protocols.
• #258: erasure tombstone, restore replay, fencing, checkpoint, and receipt interfaces.
• #259: invalidation/processor operation, ambiguity, receipt, generation/watermark, and reconciliation interfaces.
• #247, #248, and #249: accepted MemberProfile schema/service, compatibility projections, onboarding states, SlackAccessGrant, reveal/resend denial behavior, and invite-version semantics.
• #49: accepted website EmailDelivery/logical-intent, cancellation/reconciliation, projected-state, and Relay boundary.

The #64 parent coordinates policy and HUMAN closure; it is not itself an implementation interface. #250 is a downstream Studio/admin consumer of this adapter, not a prerequisite; do not create a #250 ↔ #251 cycle. #32/#33 are required for later management-surface activation owned by #250, not for a backend-only #251 adapter.

Operational activation gate

Accepted execution-disabled interfaces are sufficient to groom and later test a backend-only adapter with synthetic data. They do not authorize live privacy execution. Production/protected-data activation remains separately gated by the accepted #254 authority row and HUMAN values, enabled production registrations in #255–#259, #66 restore/startup enforcement, applicable #49 Relay readiness and processor receipts, and every owning operational lifecycle. Until then, production registration and execution must fail closed; a delivered backend slice uses Refs #251 and leaves this issue open.

Apply #23's owner-approved full-erasure direction and approved provisional retention defaults. Preserve the explicit already-issued real-name certificate exception and non-PII reconciliation evidence exactly as the privacy authority defines; do not invent broader retention exceptions.

Course registration snapshots and educational records remain courses-owned and follow #64/#242 policy. This child supplies member-domain hooks/results only and never directly rewrites course rows.

No production-data operation, policy invention, public UI, generic accountless rights flow, global processor inventory, Slack API/SCIM revocation, raw link export, or unrelated domain deletion.

Raw acceptance direction

• Account export includes the owner's profile fields, completion/revision metadata, grant and safe delivery-state metadata, and compatibility-projection provenance; it never returns the Slack URL, another member's data, provider payload/body, credentials, or unsafe internal identifiers.
• Correction flows through the normal accounts service and revision/audit contract.
• Full erasure removes/anonymizes every member-profile PII field as the accepted #64 primitive requires, denies future Slack reveal/resend, cancels safe unsent work, clears compatibility/search/cache/export copies, propagates to Relay/provider state where authorized, and leaves only bounded non-PII tombstone/reconciliation evidence. It does not claim to remove an already-used external Slack membership.
• Retry/crash/resume/concurrent request is idempotent; partial processor failure remains visible and retryable; legal/retention exceptions fail closed and are explicit; restoring a pre-erasure backup replays the tombstone before profile use, reveal, export, or send.
• Test active/incomplete/quarantined/deleted profiles, rotated grants, queued/in-flight/ambiguous/suppressed deliveries, export authorization/non-enumeration, correction races, erasure replay, cache/search rebuild, provider failure, restore, and artifact/log/audit canaries using synthetic data only.
• Browser screenshots are required only for changed rights/Studio surfaces selected by the verification graph; backend-only adapters may mark screenshots not_applicable with graph evidence. Never capture member values or the Slack link.

PM must bind the exact accepted #254 register/manifest identity, #255–#259 service/event/receipt/tombstone schemas, #247–#249/#49 domain symbols, field-level erasure-versus-retention matrix, processor behavior, and accepted prerequisite merge SHAs before removing needs grooming.

Start with parent issue #64 and the accepted contracts required from #254–#259, #247–#249, and #49; this issue does not name implementation files or entry points. Confirm the exact merge SHAs and schemas before grooming the adapter. Done means synthetic-data coverage for export, correction, erasure, retries, restore, processor failure, and safe non-disclosure, while production execution remains disabled.