# 7. cp9 purge and cp9 inventory are complementary, not overlapping

Status: Accepted

## Context

`cp9 purge` already backfills cp9 scope tags onto some untagged resources during
its trusted-parent tag assurance (ADR 0001). `cp9 inventory volumes` also reasons
about untagged resources. At a glance these look redundant, which invites
collapsing inventory into purge. They are not redundant: they handle disjoint
classes of untagged resources, and conflating them would either drop the
account-leak use case or weaken purge's safety boundary.

## Decision

Keep both commands. Their boundary is:

**`cp9 purge` — act, but only on provable scope.**
Purge cleans resources that carry `cp9-owner` + `cp9-session`, plus untagged
resources it can attach to a **trusted parent** (a verified cp9-tagged VPC, EKS
cluster, load balancer, or IAM role). For those children it backfills the scope
tags and lets aws-nuke delete them in scope. It **refuses** any resource it
cannot prove this way — name-only inference is rejected (ADR 0001). Purge is
destructive.

Untagged is not the boundary by itself: untagged children with trusted-parent
proof are purgeable; standalone untagged orphans without that proof are not.

**`cp9 inventory` — see and explain, never act.**
Inventory is read-only attribution for the resources purge intentionally will
not touch: **orphaned / standalone untagged resources with no live trusted
parent** (the canonical case is a detached EBS volume whose instance and cluster
are already gone). It classifies them (confirmed / probable / unknown, with
evidence and confidence), reports missing labels, and recommends a safe action
(`supported_by_aws_nuke` / `requires_quarantine` / `not_cleanup_eligible`). It
never mutates tags or deletes.

The handoff: inventory surfaces orphaned resources and the evidence for them;
only after a human/quarantine step establishes scope do they become eligible for
deletion. Orphan handling must never be folded into the destructive purge path,
because adopting a resource by weak inference and then deleting it is exactly the
unsafe behavior ADR 0001 forbids.

## Consequences

- Purge stays small and fail-closed; inventory stays read-only.
- The account-leak use case (untagged orphans purge cannot see) keeps a home.
- The distinction is surfaced where it is easy to miss: in both command help
  lines and the two command doc comments, which cross-reference each other.