Offboarding writes down what it did

Offboarding was doing the work and keeping no record of it. Every suspend, every Drive transfer, every deletion and alias existed as a line in a server log and a key buried in the leaver's own row. Nothing wrote to the activity log, which meant a transfer that never ran stayed invisible until somebody noticed an email that should have arrived and did not.

Each step now emits its own event, start, completion and failure separately, so a transfer that began and never finished reads differently from one that was never scheduled. That is the distinction the old record could not make and the one that matters when you are reconstructing what happened to somebody's files.

This brings offboarding to the standard the just-in-time expiry path already held itself to, where a grant that could not be revoked says exactly that rather than being quietly marked as expired.