Bind a store to one tenant. Throws unless tenantId satisfies TENANT_ID_PATTERN.
Delete every record stamped with this tenant, returning the count — the
in-memory mirror of the D1 purgeTenant approvals delete (in-memory hosts
have no D1 for that function to run against). Factory-level like
system(): offboarding is not a request-scoped capability.
The cron-only cross-tenant view (SLA sweep). Never request-scoped.
In-memory factory over ONE shared Map. Not decoration: two independent
new InMemoryApprovalStore(...)instances hold separate Maps, so a cross-tenant get/transition test against them passes trivially without exercising the tenant predicate — the exact "InMemory hides what D1 does" divergence the shared contract suite exists to close. Tenant A and tenant B views minted here share the backend, like two bound D1 stores share the table.