fix: quarantine retired account identities

CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to this project are documented here.
 
+## v2.9.3 - 2026-08-01
+
+- Replace the normal invite's foreground 65-second deferred-job drain with a
+  durable monotonic UID/GID allocator. The allocator advances a root-owned
+  high-water file before `useradd`, pins the account and its private group to the
+  same explicit ID, and never returns a burned ID to this tool after rollback or
+  deletion. Default generated usernames use substantially more entropy and take
+  two immediate process/job cleanup passes before activation. An explicit
+  `--user` can reuse historical name-keyed cron state, so that exceptional path
+  retains the synchronous drain and says why. Upgrading a pre-v5 registry starts
+  one 65-second isolation window for identities that older releases may already
+  have retired; a generated-name invite attempted inside that one-time window
+  still drains synchronously, while later generated-name invites do not wait.
+- Make ordinary revoke return promptly without releasing a possibly reusable
+  identity too early. It immediately strips sudo and sshd grants, disables login,
+  terminates UID processes, and clears cron/at work, then keeps the passwd name,
+  UID, and GID in a durable systemd-backed quarantine for at least one daemon
+  polling cycle. A separate persistent timer repeats the checks and finishes
+  Home/mail/account deletion after the deadline, including after reboot. Hosts
+  without systemd retain the fail-closed synchronous drain. Before handing work
+  to that timer, revoke installs or verifies a sufficiently new stable command;
+  if it cannot, deletion stays synchronous. Uninstall likewise finalizes
+  synchronously before removing the command required by the timer.
+- Upgrade the registry to v5 with the monotonic-identity and quarantine state,
+  separate expiry and quarantine unit namespaces, exact `doctor` validation,
+  menu recovery for proved pending generations, and status output for
+  quarantined or externally removed accounts. A v5 registry whose high-water
+  file is missing fails closed rather than reconstructing a value that could
+  reuse an already retired identity.
+
 ## v2.9.2 - 2026-08-01
 
 - Validate conventional mail-spool roots before `useradd`, then reopen and

README.en.md

@@ -80,7 +80,7 @@ The real private key is shown only once. Never put an invite bundle in a group c
 /usr/bin/sudo /usr/local/sbin/linux-temp-admin revoke --user xxvcc-a1b2c3d4e5
 ```
 
-By default, automatic revocation is scheduled after 24 hours. When the complete account identity can still be checked, a successful revoke removes the personal crontab, UID-matched `at`/`batch` jobs, account, home directory, SSH key, sudo grant, and any tool-created sshd exception. If the account disappeared outside the tool without a deletion-recovery witness, revoke cleans only the registry, name-scoped grants, and tasks it can still identify safely; it does not guess at Home or mail cleanup. When an already-authorized teardown persisted that witness first, recovery permits only an owner-checked conventional single-file mail-spool sweep and never recursively removes the absent account's old Home path. If a safety check or cleanup fails, the command returns nonzero, retains the account when it still exists and the registry witness, and attempts to disable any surviving account for a systemd retry or manual recovery. Revoke access immediately when work is finished even when automatic revocation is enabled.
+By default, automatic revocation is scheduled after 24 hours. On a normal systemd host, a manual or expiry revoke immediately removes sudo/sshd grants, disables login, terminates processes, and clears personal jobs before returning. The passwd name and UID/GID remain quarantined for at least one scheduler polling cycle; a persistent timer repeats the checks and finishes account, Home, and mail deletion in the background, so the terminal does not wait 65 seconds for safety. Without systemd, the same safety drain and deletion remain synchronous. If the account disappeared outside the tool without a deletion-recovery witness, revoke cleans only the registry, name-scoped grants, and tasks it can still identify safely; it does not guess at Home or mail cleanup. When an already-authorized teardown persisted that witness first, recovery permits only an owner-checked conventional single-file mail-spool sweep and never recursively removes the absent account's old Home path. If a safety check or cleanup fails, the command returns nonzero, retains the account when it still exists and the registry witness, and attempts to disable any surviving account for a systemd retry or manual recovery. Revoke access immediately when work is finished even when automatic revocation is enabled.
 
 ## Everyday commands
 

README.md

@@ -80,7 +80,7 @@ ssh -i ./xxvcc-a1b2c3d4e5.key -p 22 xxvcc-a1b2c3d4e5@203.0.113.10
 /usr/bin/sudo /usr/local/sbin/linux-temp-admin revoke --user xxvcc-a1b2c3d4e5
 ```
 
-默认会安排在 24 小时后自动撤销。对于仍可用完整身份核对的账号，撤销成功会删除个人 crontab、UID 匹配的 `at`/`batch` 任务、账号、家目录、SSH key、sudo 授权和本工具创建的 sshd 例外；若账号已在程序外消失且没有删除恢复见证，只清理可安全识别的登记、按用户名授权和任务，不会猜测删除 Home/mail。已经授权的撤销若提前持久化了恢复见证，则只允许继续核对 UID 属主的传统单文件 mail spool 清扫，绝不会按缺失账号的旧路径恢复性删除 Home。若安全检查或清理失败，程序会返回非零，保留账号（若仍存在）和登记，并尽力禁用仍存在的账号，供 systemd 重试或人工处理。即使启用了自动撤销，用完后也应立即手动撤销。
+默认会安排在 24 小时后自动撤销。正常 systemd 主机上的手动或到期撤销会立即删除 sudo/sshd 授权、禁用登录、终止进程并清理个人任务，然后在前台返回；passwd 中的用户名和 UID/GID 会继续隔离至少一个任务轮询周期，由持久化 timer 在后台复查并完成账号、Home 和 mail 删除，避免为了安全而让终端等待 65 秒。systemd 不可用时仍同步等待并完成同样的安全清场。若账号已在程序外消失且没有删除恢复见证，只清理可安全识别的登记、按用户名授权和任务，不会猜测删除 Home/mail。已经授权的撤销若提前持久化了恢复见证，则只允许继续核对 UID 属主的传统单文件 mail spool 清扫，绝不会按缺失账号的旧路径恢复性删除 Home。若安全检查或清理失败，程序会返回非零，保留账号（若仍存在）和登记，并尽力禁用仍存在的账号，供 systemd 重试或人工处理。即使启用了自动撤销，用完后也应立即手动撤销。
 
 ## 常用命令