B9 — Daycare offboarding

Step 1 — Director initiates offboarding

Director selects an effective departure date ≥30 days from today (§3.9 step 1).

[confirmation-step copy — spec §5.2 forgiving-and-resumable requires clearly-labeled confirmation before irreversible actions; exact wording not specified]

Step 2 — Family notifications (dispatched immediately)

AC1: every linked guardian receives this within 1 hour of the director's notice.

Step 3 — Reminders

Parents receive reminders at T-14, T-7, T-1 days.

AC2: T-14, T-7, T-1 reminders dispatched on schedule.

Step 4 — Data export (for the director)

Export bundle contains: child roster (name, classroom, consent), photo archive (all photos within 90-day window), guardian list. Downloadable throughout the 30-day window.

AC3: export is generated and downloadable for the full 30-day window.

Step 5 — Last-day execution (T=0, local end-of-day)

• All active subscriptions scoped to this daycare are cancelled.
  Access persists through end of billing period; no pro-rata refund (Appendix A item 1, resolved 2026-04-21).
• Teacher accounts at this daycare are deactivated.
• Admin accounts are downgraded to read-only for a 30-day grace so the director can still download the export bundle.

Step 6 — Grace period expiry (30 days after effective date; 60 days after notice)

All photos, child records, consent records, guardian links, and teacher assignments at this daycare are permanently deleted.

I-ChildDataDeletion: the Daycare record itself is archived with historical metadata (payout totals, referrer code) but no PII or photo data (§5.1).

AC4: all photo data for the daycare is hard-deleted by the end of the grace period.

Error — director cancels within the 30-day notice window

Allowed (§3.9 error case 1). Notifications walk back gracefully; subscriptions resume.

AC5: a cancelled-before-effective-date offboarding leaves no user-visible trace; parents see a "cancelled" follow-up notification.

Error — director cancels after the 30-day window elapsed

Not supported. Transition is irreversible once subscriptions have cancelled. Director must re-onboard via a new access code (§3.9 error case 2).

B-Retention (§3.11) — periodic photo-retention job

Runs daily at 3:00am UTC. Enforces Q1 (90-day retention).

• Any photo whose captured_at + 90 days < now is soft-marked, then hard-deleted within 24h.
• For a Child with left_daycare_at non-null: photos tagged exclusively with that child are deleted 7 days after offboarding (grace period). Shared photos tagged with other still-enrolled children have only the leaving child's PhotoDelivery records removed; the photo file is preserved until its own 90-day boundary.
• For a Daycare past offboarding grace: all photos hard-deleted, bypassing the 90-day window.

Hardest invariant in the system: no photo persists past 90 days under any circumstance (I-Retention, §5.1).

B-ChildOffboard (§3.14) — single child leaves daycare

Invoked when director marks Child.left_daycare_at (past, today, or future).

On effective date:

• Child removed from classroom roster (no longer appears in teacher's tag list).
• Family subscription tier recalculates per Q5 on next billing cycle (not immediately; §3.14 step 2, AC1).
• Retention enforcement handles the 7-day photo-deletion grace (B-Retention step 2, AC2).
• Guardians notified and given the download window.

Edge cases (§3.14)

• Only child in a family marked as left. Family subscription enters a "no active children" state. Auto-cancels at end of current billing period (or immediately on director instruction).
• Child re-enrolls within the 7-day grace. Reactivate Child; photos not yet deleted are restored (AC3).