Purge review

Server-side deletion is gated: candidates are computed from each account's retention window, verified against the archive, then must be reviewed here before purge_execute deletes them from the provider. Raw archive copies are never deleted. Click a subject to open the archived copy.

No pending candidates.