Reattach deleted account's inventory to user's new account (support case aubadass)

Context

Support case (Featurebase, opened Aug 6): user aubadass lost access to their account and all their inventory overnight.

Root cause: their account had a deletion request from April 29 (requested 19:32:27 UTC, confirmed 29s later, scheduled for May 6). The deletion job was broken at the time and never ran; the user kept using the account all summer (last inventory change July 14, CSV export July 18, last sync Aug 1). When the deletion feature was fixed in August, the stale request executed on Aug 4 at 04:01 UTC, deleting their Clerk login and anonymizing the user row. On Aug 6 the user signed in again with the same Google address and got a fresh empty account.

The user's collection was verified against the CSV export they attached in the support thread — exact match, line for line.

Accounts

• Old (deleted) user: 69bbcccad5a6e6043d7081d0 — anonymized (deleted-3d7081d0), deletion_status = deleted, created 2026-03-19
• New user: 6a74426727b07fa37709c8a8 — username aubadass, email jdub111085@gmail.com, created 2026-08-06

What's intact

The old account's inventory was never purged: 13,060 live lines / 16,403 cards (inventory rows with is_latest = true, valid_to IS NULL), mostly French Magic. Only PII (email, username, Clerk id) was scrubbed.

Task

Reattach the old account's inventory (and any related per-user data that survived: locations, tags, lists if present) to the new user id 6a74426727b07fa37709c8a8, so the user sees their full collection again.

Things to watch:

• The inventory table is versioned (line_key, valid_from/valid_to); the reattachment should preserve line identity and history consistently.
• Check inventory_location, inventory_tags, and list membership for the old user id and migrate them together.
• The new account may already contain a few lines the user re-added since Aug 6 — merge, don't clobber.

Support (Julie) has told the user their collection is safe and restoration is coming soon — please ping her when done so she can close the loop with the user.

Follow-up (separate concern, may deserve its own issue)

A deletion request months past its scheduled date executed without re-validation, even though the account had been actively used up to 3 days before. Stale requests should be re-confirmed or cancelled by account activity.