mrhid6andClaude Opus 5
4e90e8619f
The control plane owns deletion because it is the only service that knows what an instance is made of; mirroring that collection list into admin would drift, and a drift here deletes the wrong rows. Defaults OFF. Eligibility is three positive assertions — Free tier, an expiry that exists, and an expiry past the window — so a missing or stale field is never eligible. The instance document is deleted last, making an interrupted purge retryable rather than orphaning rows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>