We need a mechanism to handle user deletions and long-term suspensions in compliance with privacy expectations ("Right to be Forgotten"). Currently, users who return 404s are moved to the Penalty Box (failed.json) indefinitely if they have prior history.

The Solution: Penalty Box Retention Policy (TTL)

1. Schema Migration: Convert apps/devindex/resources/failed.json from a simple Array ["login"] to a Map {"login": "2026-02-13T..."} to track when the failure first occurred.
2. Cleanup Logic: Update Cleanup.mjs to check this timestamp.
3. Policy: If a user remains in the Penalty Box for 30 Days:
   • Assume the account is permanently deleted or banned.
   • Hard Delete: Remove from users.jsonl, tracker.json, and failed.json.
   • Log the deletion.

This ensures that our index eventually reflects reality and respects user deletion.