postgres: a withdrawn consumer keeps its database; retiring renames, never drops (hq issue 241)

modules/postgres/provisioner/index.ts

@@ -41,9 +41,13 @@ runProvisioner("postgres-database", {
     });
   },
 
+  // **Withdrawn, never dropped** (novox/hq issue 241). The login is locked and the database kept
+  // under its own name: on 2026-10-04 a misread contributions file withdrew every consumer at once,
+  // and dropping made that a loss of seven databases. Taking a database out of service is a person's
+  // act — the postgres_retire_database tool — and even that renames rather than drops.
   async remove(p: { as: string }): Promise<void> {
-    await postgres.dropDatabaseAndRole(p.as, p.as);
-    await announce("database.deprovisioned", { database: p.as });
+    await postgres.lockRole(p.as);
+    await announce("database.deprovisioned", { database: p.as, kept: "true" });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).