Story-2872 · EPIC-2834 T3-sweep

One lifecycle event now closes every W3 door

CC-42 is a single-switch guarantee. When a channel identity is unbound, remotely logged out, or removed from a firm, the same transaction now kills its binding, pending fetch links, pending confirmations, and ability to originate a run. The conversation session is deliberately retained as read-only history.

The mental model: revoke authority, not history

lifecycle event
      │
      ├── binding             → revoked
      ├── revocation epoch    → advanced for pair-wide sweeps
      ├── fetch link          → revoked
      ├── confirmation        → aborted
      ├── run origination     → denied by live binding / epoch checks
      └── conversation        → preserved for read-only history

Every mutable kill happens inside the event's existing transaction.

Each event keeps its intended blast radius

Event	Sweep boundary	Result
Unbind / admin revoke	One binding	That binding's fetch links and confirmations die; sibling bindings remain live.
Firm offboard	One firm + user pair	The existing revocation-epoch sweep kills every W3 artifact in that firm.
Remote logout	All binding firms for the authenticated user	Every binding, fetch link, and pending confirmation dies account-wide.

The implementation reuses both predecessor mechanisms

There is no second sweep and no schema change. Story-2863's revocation-epoch paths remain the authority for fetch links and run origination. Story-2867's pending-confirmation store remains the authority for confirmation state. Story-2872 only connects the missing lifecycle edges to those stores.

Remote logout runs in the pre-firm AppMe bracket. Confirmation rows are intentionally user-private, so the sweep temporarily enters the existing owner-scoped confirmation policy for that one bulk update, then restores the AppMe bracket before audit work. This preserves RLS; it does not add a privileged policy or bypass.

Acceptance proof

Proof	Observed result
Canonical pytest-bdd CC-42 scenario	Offboard aborts the confirmation, revokes the fetch link, blocks binding resolution, and preserves the seven-turn session.
Precise unbind	The target confirmation and link die; a sibling binding's pending artifacts remain untouched.
Remote logout	Three confirmations and three links across two firms die; an unrelated user's artifacts remain live.
Atomic rollback	A planted confirmation-update failure rolls back epochs, bindings, links, confirmations, and audit rows together.
Constant query shape	One binding and three bindings both complete in eleven request-level database calls.
Structured outcome	Each sweep logs its reason and counts for firms, bindings, fetch links, and confirmations.