# Retain the Customer-Account Image Cache

Normal `cp9 destroy` retains the customer ECR repositories and images mirrored
for BYOC. They use the production repository paths and `ManagedBy=PingCAP` tag
and are scoped to the customer account plus image-sync region, not to one CP9
session. A later serialized session reuses verified digests and mirrors only
missing or changed members of its core image closure.

Create/reuse and every completed-stage revalidation require the exact
partition, customer account, image-sync Region, and production repository path
in the repository ARN. The live resource tags must be exactly
`ManagedBy=PingCAP`; wrong identity, extra ownership, or tag drift fails closed
before cached image digests can satisfy readiness.

This matches production `docker-image-controller`: its
`auto-deploy-sync-image` role can describe, create, tag, push, and read but
cannot delete repositories or images. Destroy reports the retained registry as
an account-level managed cache and excludes it from session zero-residual
accounting; it is not a cleanup survivor. Removing the cache belongs to a
separate customer-account retirement workflow with explicit broad deletion
authorization, not ordinary region/session teardown.