feat(identity): enforce lifecycle audit semantics

docs/IDENTITY_MODEL.md

@@ -10,6 +10,32 @@ authenticate and independent of what they may do.
 - Primary account: the account used as the default display/explainability
   anchor when multiple accounts exist.
 
+## Lifecycle semantics
+
+An active identity is eligible for ordinary directory search. Deactivation
+removes it from default search results but does not delete the identity, its
+account links, their source provenance, or the primary-account marker. Direct
+identifier/account resolution retains the record with an explicit `inactive`
+status so Access and reconcilers do not mistake deactivation for absence.
+Authorized lifecycle owners may also include inactive identities in search and
+may reactivate them. Deactivation is therefore a reversible directory-state
+change, not account suspension or erasure; Access owns those separate
+consequences.
+
+Each account link records the origin of the accepted association in `source`
+(for example `local` or an IDM reconciliation source). The source is provenance,
+not authorization and not proof that the external source remains reachable.
+Changing the primary account never rewrites this origin.
+
+An identity may retain multiple account links but has at most one primary
+account. A primary-account change may select only an existing link belonging to
+that identity, atomically demotes the previous primary, preserves every link,
+and records old/new account ids plus link-source provenance in the audit log.
+The lifecycle service does not commit: its caller authorizes the operation and
+commits the state and audit record together, or rolls both back on validation,
+audit, or persistence failure. Repeating the already-effective selection is a
+no-op and does not create misleading audit activity.
+
 ## Boundary With Access
 
 Access owns authorization. Identity only tells access which identity is behind
@@ -48,3 +74,7 @@ Rollout plan:
 
 The close-out condition is that Access works with canonical Identity installed
 and still works without it through the projection fallback.
+
+The current lifecycle service is intentionally not an administration API.
+Identity administration screens and endpoint permissions remain tracked
+separately; IDM continues to own external import/reconciliation decisions.