--- id: STATE-ACC-BKS-005 title: Workspace standing and Accounting availability object: DOM-ACC-BKS-006 product_area: accounting module: books revision: 1 status: draft design_intent: proposed implementation_evidence: partially-observed source_sha: services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 states: - name: unknown meaning: >- Platform has no workspace row, so Accounting refuses availability even for staff. - name: provisioning meaning: >- The observed workspace is being provisioned, so ordinary Accounting requests are unavailable. - name: loading meaning: >- Ordinary callers can use data-job paths while other paths are unavailable; staff receives the general staff exception. - name: active meaning: >- The workspace has active lifecycle standing; ordinary availability also requires an enabled status and route permission. - name: disabled meaning: >- Disabled is a status restriction on active lifecycle standing, rather than a separate lifecycle state. - name: deleting meaning: The deleting state admits staff reads only and allows guarded purge calls. transitions: - from: unknown to: provisioning trigger: Observe Platform provisioning guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: provisioning to: loading trigger: Observe Platform loading guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: provisioning to: active trigger: Observe Platform activation after provisioning guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: loading to: active trigger: Observe Platform activation after loading guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: active to: disabled trigger: Observe disabled status guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: disabled to: active trigger: Observe re-enabled status guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: active to: deleting trigger: Observe deletion standing guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: deleting to: active trigger: Observe a changed state after deletion guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 - from: deleting to: unknown trigger: Observe removal of the Platform row guard: >- The owning Platform transition and its completion guard are not established by Accounting code side_effects: [] who: Platform; transition authority is unverified here provenance: unknown source: FND-ACC-BKS-052 invalid: - from: active to: unknown why: >- The gate distinguishes an existing row from absence, but does not define which Platform transitions may remove that row. - from: active to: active why: >- Purge is refused while the observed workspace is active; that is a purge guard rather than a lifecycle transition rule. concurrency: >- Availability reads use a per-process cache with a thirty-second lifetime. Purge rechecks the uncached Platform state inside each batch. Accounting’s lifecycle Lambda has reserved concurrency one, while Platform owns the order and continuation of calls. invariants: - INV-DOM-ACC-BKS-006-07 - INV-DOM-ACC-BKS-006-09 evidence: - >- services-accounting at f47cb263: modules/maintenance/services/lifecycle/tenant-availability.ts, tenant-lifecycle-operations.ts; services/persistence/tenants.ts, tenant-purges.ts --- # Workspace standing and Accounting availability ## The Lifecycle ```mermaid stateDiagram-v2 state "unknown" as s0 state "provisioning" as s1 state "loading" as s2 state "active" as s3 state "disabled" as s4 state "deleting" as s5 ``` ## Transitions Explained This model describes Accounting’s response to observed Platform states. Its structured transition outline remains unknown because the examined gate does not implement Platform’s lifecycle. The diagram therefore lists observed conditions without asserting allowed moves. Unknown workspaces are unavailable. Deleting workspaces permit staff reads. Loading permits ordinary data-job routes; staff otherwise receives its broader exception. Other ordinary requests require active standing and a status other than disabled. Route permissions still apply. ## What Cannot Happen Accounting’s gate does not change Platform standing. Purge requires a fresh deleting-state check before each batch. The examined console and portal routes do not exercise the staff exception reserved for system callers. ## Concurrency and Timing A cached availability result can delay recognition of a changed state by up to thirty seconds within a process. Purge does not use that cache. A state change after partial erasure can stop subsequent batches but does not restore removed data.