Soft-delete every QA tenant, RETRACT its published marketplace listings, and revoke its QA memberships. QA users remain (append-only store) but stay namespaced + excluded via is_qa_subject. Each QA tenant's promoted listings are cleared (reversible takedown) BEFORE the tenant is deleted, so no orphans are created.

The orphan sweep (retract listings whose owning tenant is gone) is OPT-IN only — body {sweep_orphans: true} — because it is deletion-by-absence: a corrupt/partial tenants.jsonl replay could drop a real tenant from the live set and silently retract its storefront. It also takes {dry_run: true} (list what it WOULD clear, change nothing) and refuses to clear more than SWEEP_CAP listings unless {force: true}. default is always protected.