---
id: WF-PFM-OPS-009
title: Remove a deleted workspace’s operational records
product_area: platform
module: operations
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
trigger: Workspace deletion invokes operational lifecycle participants during purge.
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
  - CAP-PFM-OPS-001
  - CAP-PFM-OPS-010
  - CAP-PFM-OPS-012
  - CAP-PFM-OPS-015
moves: []
crosses:
  - SVC-PFM-OPS-jobs
  - SVC-PFM-OPS-audit
  - SVC-PFM-OPS-licensing
idempotency: >-
  Batched deletion can continue after earlier rows have gone. Each participant reports its remaining
  inventory, allowing the owner’s purge workflow to resume removal.
concurrency: >-
  The audit purge function requires deletion state and matching workspace context. Job deletion excludes the
  active deletion schedule and purge identities.
hops:
  - 'n': 1
    actor_or_service: Jobs purge
    action: >-
      Delete bounded batches of workspace job roots, cascade their steps and events, and remove matching
      notices while retaining the deletion’s own jobs.
    anchor: 'services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES'
    seam: sync
    on_failure: Let the purge workflow apply its failure and retry policy.
    left_inconsistent: Some operational job records can be gone while others remain.
    observer: Purge step history and the post-removal row inventory.
    provenance: observed
    source: 'services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES'
  - 'n': 2
    actor_or_service: Audit participant
    action: Remove bounded event batches through the protected function after asserting workspace deletion.
    anchor: 'services-platform:modules/audit/services/lifecycle/tenant-participant.ts'
    seam: sync
    on_failure: Refuse a workspace outside deletion; propagate other failures to purge handling.
    left_inconsistent: Activity removal may be incomplete across batches.
    observer: Purge job and the inventory is the observation surface.
    provenance: test
    source: >-
      services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#is
      refused by the database, so the purger is never a delete-by-tenant tool
  - 'n': 3
    actor_or_service: Licensing participant
    action: Remove workspace overrides and application rows while retaining company contracts and windows.
    anchor: 'services-platform:modules/licensing/services/maintenance/tenant-participant.ts:licensingParticipant'
    seam: sync
    on_failure: Propagate persistence failure to the workspace purge workflow.
    left_inconsistent: >-
      Workspace licensing removal may be incomplete, while shared company records remain intentionally
      retained.
    observer: Purge job and the inventory is the observation surface.
    provenance: observed
    source: 'services-platform:modules/licensing/services/maintenance/tenant-participant.ts:licensingParticipant'
branches: []
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/jobs/services/persistence/tenant-purges.ts;
    modules/audit/services/lifecycle/tenant-participant.ts,
    services/persistence/audit-events.ts:purgeTenantAuditEvents;
    modules/licensing/services/maintenance/tenant-participant.ts;
    modules/tenants/services/lifecycle/participants.ts; docs/audit-events.md#Tenant deletion.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Remove a deleted workspace’s operational records

## What It Does

Workspace purge removes the operational account belonging to the deleted workspace. Its deletion jobs are preserved, and company-level contract data remains for any other linked workspace. Each owner contributes its bounded removal and inventory.

## The Flow

```mermaid
flowchart TD
  H0["Delete bounded batches of workspace job roots, cascade their steps and events, and remove matching notices while retaining the deletion’s own jobs."]
  H1["Remove bounded event batches through the protected function after asserting workspace deletion."]
  H0 --> H1
  H2["Remove workspace overrides and application rows while retaining company contracts and windows."]
  H1 --> H2
```

## When Something Fails

Purge can leave a partially removed workspace between batches or after a failed participant. The workspace owner controls retries and final purge status; a participant does not guarantee endless automatic retry. Ordinary application privileges cannot delete activity events, and the protected function checks deletion before removing them.

## Open Design Questions

Current activity removal depends on workspace deletion. A retention policy would need its own authorized removal mechanism.