010 — revoked vs soft-delete

Context

A user_domain can end because the user removed it, or because another account successfully claimed the hostname. Collapsing those into one end state confuses audit history and UX ("I deleted it" vs "someone took it").

Decision

Keep both:

• deleted_at — user soft-deleted via domains.delete; may re-add the hostname later.
• status = revoked + revoked_at — ownership lost via successful claim transfer only.

revoked_at is already on user_domains; it is not exposed on the public API yet.

Consequences

• List/get queries continue to treat soft-deleted rows as gone for the user.
• Revoked rows remain queryable for history and notifications.
• Do not use soft-delete for claim transfers.