We won't be adding this to the UI. Like with most other objects and applications, it is intentional that objects can not be permanently destroyed from the web UI. Among other things, this severely limits the damage a malicious or compromised user can cause.

Support for remove destroy and allowing you to leave threads are both reasonable, though.

I filed bin/remove support in T7694.

The same issue happens when you try to add a new user to a thread containing a user that was destroyed. The destroyed user shows up in the list as Unknown Object (User) and I receive the same Validation errors: - New thread member "PHID-USER-…" is not a valid user. message.

I would also like to see complete purging of users from the DB, to ensure there are no more references that could cause trouble like this. Objects which are attributed to that user could be re-attributed to a dummy "destroyed user" (even one I have to create manually, if that simplifies the implementation for you).

Objects which are attributed to that user could be re-attributed to a dummy

Just rename the user account to "dummy1" if this is what you want.

I would also need to remove all linked authentications and the email address (and potentially SSH keys, etc), since I will have to reuse both. And in my case the user is already destroyed, so there is no way back anymore.

Thank you, solved my issue!