No LIVE custom role of that name in this tenant. A role already soft-deleted answers 404 rather than 204: the delete is not idempotent on a name, because after PRD §156 D4 that name is free again and a later 204 would suggest something was deleted when the name may since have been re-created.

The role still has at least one LIVE holder. A tenant custom role is held by human users, via user_roles, and by nothing else: a Cryptographic Actor is assigned roles only through an allowlist of lowercase dotted capability scopes, which no uppercase tenant role name can match, and the schema declares a composite foreign key on actor_roles admitting only the global, non-system catalog rows. Soft-deleted holders do NOT block — their assignment rows are kept because they are audit-bearing, but they are excluded from the count, so a role whose only assignees have been deleted still deletes cleanly. The detail names the live count. Reassign those users, then retry.