A withdrawn consumer keeps its data, in every provider that holds some (hq issue 241)

mssql disables the login, mongodb takes the user's roles, minio revokes the key and keeps the bucket,
mailu disables the mailbox, gitea prohibits the login instead of purging the user and their
repositories, umami keeps the website. Each provider's create already enables what this locks.

modules/mailu/client.ts

@@ -140,6 +140,11 @@ export class MailuClient {
     await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { raw_password: password, enabled: true });
   }
 
+  /** Withdraw a mailbox and keep its mail: disabled, which applyProvisioned undoes. */
+  async disableUser(email: string): Promise<void> {
+    await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { enabled: false });
+  }
+
   async deleteUser(email: string): Promise<void> {
     await this.api("DELETE", `/user/${encodeURIComponent(email)}`);
   }

modules/mailu/provisioner/index.ts

@@ -75,7 +75,9 @@ runProvisioner("smtp", {
     // exists, and left otherwise — a mailbox holding mail is the one thing a background loop
     // must not guess about (this module's own events file says the same). Withdrawal of a
     // named-account consumer is an operator action until the harness carries values here.
-    await mailu.deleteUser(`${p.as}@${domain()}`).catch(() => {});
+    // Disabled, never deleted (novox/hq issue 241: a withdrawal never destroys a consumer's data — on 2026-10-04 a misread grants file withdrew every consumer at once): a mailbox holding mail is the one thing a background loop must
+    // not destroy. applyProvisioned enables it again when the consumer returns.
+    await mailu.disableUser(`${p.as}@${domain()}`).catch(() => {});
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).