# cleanup-lock

Exact and scheduled `cp9 destroy` for every runtime account share one DynamoDB lease in coordinator account 804. One table, not a copy per target: two cleanups must not reap the same account at once. A missing table fails closed — the cleanup runtime never creates it, so a denied write cannot invent a local lock and proceed.

## Who

Account-804 admin.

## When

Before enabling a cleanup workflow version that acquires the lease. Once globally — not per session, not per target account. Proof before that enablement: ACTIVE table plus a successful conditional acquire / renew / release through the 804 coordinator identity.

## Floor

Read [`../../live-floor.md`](../../live-floor.md) and run those steps.

Owner: `804837308162`. Name: DynamoDB table `cp9-session-cleanup-lock`. Lookup: `dynamodb describe-table`.

Missing create: PAY_PER_REQUEST, hash key `account_id` (S), TTL `expires_at`, deletion protection on.

## Completion

`cp9-session-cleanup-lock` is `present`, `created`, or `left-in-place` in account 804.