I'm slightly surprised they didn't use a "Trashcan" model where the data is moved elsewhere before being deleted, so in the event that a critical service is bro

I'm slightly surprised they didn't use a "Trashcan" model where the data is moved elsewhere before being deleted, so in the event that a critical service is brought down by the deletion of a piece of data no one realized it needed, it can be restored. Maybe they just assume any good service worth its salt must have proper (out-of-band) backups for that kind of event, since Janitor Monkey deletion is basically equivalent to any other kind of data loss.