fn subtree_of( state: &AppState, did: &str, ) -> Result<Vec<String>, ProvisionError>
did and everything beneath it, deepest first — the order a hard delete has to take them in.
did