IMO Google has the right approach with "advance directive"
options, while respecting owner's absolute right to not permit
others to take over their account if that's what they prefer.
For GIO, "sunset" actions would be triggered if no owner posts to the list, or sends email to +owner (which might be monitored by other moderators), or logs into groups.io for a specified number of days.
I think the following options are enough (each with its own
sunset period). Multiple actions of the same kind would be
Just Notify: Send an email to arbitrary recipients
(possibly including the list) with a user-specified message. The
timer continues ticking.
Discussion: Owner might privately give their password to someone who could take over. Or they just want someone to remind them if needed and if they are still alive/capable of acting. The timer keeps ticking if there are any other actions with longer timeouts, such as Delete.
Add Owner: Add specified email addresses as
Owner(s) (upgrading existing subscribers, otherwise just waiting
for that email to subscribe). The timer keeps ticking.
Discussion: It would be up to a new Owner to delete the old Owner
if appropriate, i.e. if they were dead.
Change Settings: Change any of the things under
"Settings". The implementation probably would run a special copy
of the Settings dialog to collect the info and then save the
results, to be slammed into the real settings when the timeout
Discussion: This is the most general way for Owners to arrange to
transform a group after they are gone, for example by changing the
"Description" to indicate the group is 'legacy' or 'archived'.
They might also enable all Members to download archives if not
previously allowed, disable posting except by Moderators, etc.
Freeze: Sugar for "Change Settings" to prevent all
further activity (no posts, no editing, etc.) and to install a new
Discussion: If an Owner later appears, they could, of course,
revert the settings and resume normal operation. Paid accounts
would automatically revert to "free" status if payments stopped
being made, thereby reducing storage limits, and at that point
files and attachments might be deleted, but not message bodies.
Permanently Delete: Delete the group and all
archived content, optionally sending a specified "Epilog" message
to the list (this might be implemented internally with a "Notify"
event a few days before the actual group is deleted).
Discussion: Any owner always has the absolute right to delete the
group without notice; this is just a way to do so "posthumously".
GIO Enforced Delete: All groups would have a
non-disablable "Permanently Delete" action with some distant
timeout, e.g. 5 years, subject to acceleration (with advance
notice) by group.io if applied equally to all groups.
Discussion: Necessary to protect groups.io from an unlimited obligation to provide free resources to store, index, and serve dead groups.