---
id: ADR-PFM-SEC-004
title: Separate business status and lifecycle
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Store staff-controlled business status separately from lifecycle readiness/destruction and enforce
  their compatible combinations in the database; ordinary edits cannot set lifecycle.
constrains:
- DOM-PFM-SEC-002
- STATE-PFM-SEC-001
- STATE-PFM-SEC-002
- SVC-PFM-SEC-tenants
- WF-PFM-SEC-001
- WF-PFM-SEC-002
- WF-PFM-SEC-003
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes; loading added by
  the Data Job Engine plan §12.1 (Andrew 2026-10-11)
alternatives:
- option: Combine readiness and business classification into one status.
  why_not: That obscures deletion protection and turns compatibility into conventions that individual writers
    can miss.
consequences:
- Availability evaluates both axes with the documented HQ and loading exceptions.
- Retirement requires disabled business status; loading requires implementation status.
- Lifecycle services use a declared transition graph, with the explicit operator restore exception.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Separate business status and lifecycle

## Context

The cited lifecycle planning decision already establishes two axes. The design preserves that decision while recording the restore exception and cache behavior observed in implementation.

Loaded activation does not imply a business-status change or a new first-activation timestamp.

## Decision

Store staff-controlled business status separately from lifecycle readiness/destruction and enforce their compatible combinations in the database; ordinary edits cannot set lifecycle.

## Alternatives Considered

Combine readiness and business classification into one status. That obscures deletion protection and turns compatibility into conventions that individual writers can miss.

## Consequences

Availability evaluates both axes with the documented HQ and loading exceptions.

Retirement requires disabled business status; loading requires implementation status.

Lifecycle services use a declared transition graph, with the explicit operator restore exception.