---
id: WF-PFM-ELG-009
title: 'Expire and purge eligibility, responsibility and attention data'
trigger: >-
  Daily partition maintenance at 03:17 UTC removes expired months, and workspace
  deletion invokes module purge participants.
product_area: platform
module: eligibility
revision: 1
status: draft
design_intent: confirmed
origin: >-
  Eligibility Engine architecture D-10 (decisions kept thirteen months),
  approved 2026-10-17 (PLAT-M11 "Decisions"); the partition standard
  (docs/partitions.md) and the workspace lifecycle plan
  (docs/tenants/tenant-lifecycle-plan.md)
implementation_evidence: partially-observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
  - CAP-PFM-ELG-009
  - CAP-PFM-ELG-011
  - CAP-PFM-ELG-013
  - CAP-PFM-ELG-016
moves:
  - STATE-PFM-ELG-004
  - STATE-PFM-ELG-007
crosses:
  - SVC-PFM-ELG-eligibility
  - SVC-PFM-ELG-responsibilities
  - SVC-PFM-ELG-attention
idempotency: >-
  Partition creation and expiry repeat safely. Purge removes bounded batches and
  reports remaining work for repeated deletion steps.
concurrency: >-
  The daily maintenance operates separately from workspace-scoped lifecycle
  jobs, which remove child records before parents.
hops:
  - 'n': 1
    actor_or_service: Partition maintenance
    action: >-
      Create the current and next two months and detach and drop months beyond
      thirteen completed months, without archiving.
    anchor: 'services-platform:db/partitioned-tables.ts:PARTITIONED_TABLES'
    seam: schedule
    on_failure: >-
      Maintenance failure and silence alarms alert operators; the next daily
      invocation tries again.
    left_inconsistent: >-
      A missing writable partition rejects inserts until creation succeeds;
      deployment creation reduces the risk.
    observer: Partition alarms expose stalled maintenance.
    provenance: documented
    source: 'services-platform:docs/eligibility.md#4. Decision partitions'
  - 'n': 2
    actor_or_service: Attention sweep
    action: >-
      Remove attention supporting rows whose occurrence no longer exists and
      clear stale open-key references.
    anchor: >-
      services-platform:modules/attention/services/persistence/items.ts:deleteOrphans
    seam: schedule
    on_failure: Workspace errors are logged and retried on the next sweep.
    left_inconsistent: Supporting orphans can remain between successful sweeps.
    observer: Sweep failure counters and alarms show the delay.
    provenance: observed
    source: >-
      services-platform:modules/attention/services/sweep/sweep-tenant.ts:sweepTenant
  - 'n': 3
    actor_or_service: Run and simulation expiry
    action: >-
      Use the implemented expiry helpers for ninety-day runs and thirty-day
      simulations.
    anchor: >-
      services-platform:modules/eligibility/services/persistence/population-runs.ts:expirePopulationRuns
    seam: schedule
    on_failure: No deployed schedule invokes these helpers.
    left_inconsistent: >-
      Run results, subjects, exports and simulations can outlive intended
      retention.
    observer: There is no automatic expiry observer.
    provenance: observed
    source: 'services-platform:docs/debt/eligibility-population-deployment.md'
  - 'n': 4
    actor_or_service: Workspace deletion job
    action: >-
      Purge eight ordinary eligibility tables and use the restricted deletion
      function for decisions; job storage follows its separate lifecycle.
    anchor: >-
      services-platform:modules/eligibility/services/maintenance/tenant-participant.ts:platformEligibilityParticipant
    seam: state_machine
    on_failure: A failed participant step is retried by the deletion job.
    left_inconsistent: Deletion can remain incomplete until subsequent steps succeed.
    observer: The lifecycle job monitor shows progress.
    provenance: observed
    source: 'services-platform:docs/eligibility.md#3. Row-level security'
  - 'n': 5
    actor_or_service: Workspace deletion job
    action: >-
      Purge responsibility cover, holdings and gaps, plus attention reminder,
      response, audience, item, key, setting, preference, run and sweep records.
    anchor: >-
      services-platform:modules/attention/services/maintenance/tenant-participant.ts:platformAttentionParticipant
    seam: state_machine
    on_failure: Lifecycle execution retries failed participant steps.
    left_inconsistent: The deleting workspace can retain partial storage during recovery.
    observer: The lifecycle operator monitors the job.
    provenance: observed
    source: >-
      services-platform:modules/responsibilities/services/maintenance/tenant-participant.ts:platformResponsibilitiesParticipant
branches:
  - Shared registries are not workspace rows and are retained.
  - >-
    An open occurrence removed with its month reappears only if its provider
    republishes; generation numbering depends on whether the key remains.
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: db/partitioned-tables.ts;
    modules/*/services/maintenance/tenant-participant.ts;
    modules/attention/services/sweep/sweep-tenant.ts; docs/eligibility.md §3,
    §4; docs/attention.md §1; docs/responsibilities.md §2; docs/partitions.md;
    docs/debt/eligibility-population-deployment.md.
controls: [TC-AVL-001, TC-AVL-002, TC-AVL-003, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-DAT-007, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-PRV-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---
# Expire and purge eligibility, responsibility and attention data

## What It Does

Daily partition maintenance at 03:17 UTC removes expired months, and workspace deletion invokes module purge participants.

## The Flow

```mermaid
flowchart TD
  H1["Partition maintenance" ]
  H2["Attention sweep" ]
  H1 --> H2
  H3["Run and simulation expiry" ]
  H2 --> H3
  H4["Workspace deletion job" ]
  H3 --> H4
  H5["Workspace deletion job" ]
  H4 --> H5
```

Create the current and next two months and detach and drop months beyond thirteen completed months, without archiving. Remove attention supporting rows whose occurrence no longer exists and clear stale open-key references. Use the implemented expiry helpers for ninety-day runs and thirty-day simulations. Purge eight ordinary eligibility tables and use the restricted deletion function for decisions; job storage follows its separate lifecycle. Purge responsibility cover, holdings and gaps, plus attention reminder, response, audience, item, key, setting, preference, run and sweep records.

## When Something Fails

Maintenance failure and silence alarms alert operators; the next daily invocation tries again. A missing writable partition rejects inserts until creation succeeds; deployment creation reduces the risk. Workspace errors are logged and retried on the next sweep. Supporting orphans can remain between successful sweeps. No deployed schedule invokes these helpers. Run results, subjects, exports and simulations can outlive intended retention. A failed participant step is retried by the deletion job. Deletion can remain incomplete until subsequent steps succeed. Lifecycle execution retries failed participant steps. The deleting workspace can retain partial storage during recovery.

## Open Design Questions

Shared registries are not workspace rows and are retained. An open occurrence removed with its month reappears only if its provider republishes; generation numbering depends on whether the key remains.