The agreement's self-serve termination lever (TEA-470). The org row is deleted here, on the request path — every tenant-scoped table cascades in the same transaction, so the data is gone at the 204 — while everything the cascade cannot reach (SAML providers, the Stripe customer, orphaned members' auth users, the docs-domain edge stack) is torn down by the offboarding workflow started just before.

Ordering mirrors the docs-domain removal: connect (or refuse 503) before anything mutates, start the teardown, THEN destroy the row — started-but-uncleaned heals (the workflow's first activity re-deletes the row fleet-side), cleared-but-unstarted would orphan every external resource, and the caller cannot retry once their membership row is gone. The org's AWS Marketplace licenses are released in the delete's own transaction; a live one still bills the customer through AWS, so each pages the operator once the delete has committed.