Offboarding

A deletion nobody can evidence is not a deletion.

#The sequence

1. Move to offboarding
   The practice can no longer transact. Export remains available for the agreed window.
2. Export
   The practice owns its data and takes it in a form it can use.
3. Purge
   Every tenant-scoped collection - gates, tasks, jobs, cases, attachments - is removed for that practice id.
4. Canary
   A verification pass reads the tenant back across every collection. It must come back empty. A non-empty result blocks the state transition.
5. Record
   The audit record of the offboarding is retained. That is the evidence the deletion happened.

#The footprint check

store.tenantFootprint('p_north');
// { gates: 0, tasks: 0, jobs: 0 }   ← required before 'offboarded'

The canary reads from the same store the application uses, not a report built alongside it. A purge verified by a separate accounting is a purge verified by something that can be wrong in the same direction.

#What is deliberately retained

• The audit record of the offboarding itself, including who requested it and when.
• Aggregate operational counts that carry no practice identifier.

Nothing clinical, nothing identifying, and nothing that could be rejoined to a person.