Type Alias: TenantStatus

> TenantStatus = "provisioning" | "ready" | "failed" | "deleting" | "suspended"

Where a tenant is in its lifecycle.

A record with no status (absent or null) is treated as ready. Every tenant that existed before provisioning was introduced has no status, and they must keep serving traffic — a stricter default would 503 an entire production estate on upgrade.

ready — serves.
provisioning, failed, deleting — the storage is not (or no longer) usable: 503 TENANT_NOT_READY.
suspended — the tenant is fine, the account is not allowed in: 403 TENANT_SUSPENDED. Tenancy never writes it; the app does (billing, abuse).

Any other value — active, disabled, a typo — is refused with 500 TENANT_STATUS_UNKNOWN: tenancy cannot tell whether the storage behind it is usable, so it fails closed instead of guessing either way.