---
id: TST-PFM-SEC-224
title: Workspace deletion recovery request checks
kind: api-lifecycle
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js
implements:
  - ATS-PFM-SEC-004-01
  - ATS-PFM-SEC-004-10
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#tenant
      deletion recovery API (end to end)
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#resumeTenantDeletionSchedule
  - provenance: test
    source: 'services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#answers 200'
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#answers a new
      schedule job, and names the one it superseded
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the
      request scheduled, and its eligibility exactly where it was: a resume cannot bring a deletion
      forward
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#refuses a
      second resume as 409 while the new schedule job is alive
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#answers 404
      for a request nobody holds
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#refuses an
      anonymous call as 401
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#retryTenantPurge
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#refuses as
      409 a retry of a purge that did not fail
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the
      request exactly as it was after the refusal
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#answers 404
      for a request nobody holds
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#refuses an
      anonymous call as 401
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#what a
      customer administrator may not do
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#may read
      their own tenant, which is the premise: the context is a working one
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#may not
      resume a deletion schedule
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#may not retry
      a purge
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the
      request exactly as it was after both refusals
dependency_evidence: >-
  The local request harness exercises the route dispatcher and the prepared database. The suite
  controls workflow execution, remote service participants, the signing key at the declared seams;
  those collaborators remain outside its live proof.
evidence:
  - 'services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js'
  explicit_no_doubles: false
  identified_double_boundaries:
    - workflow execution
    - remote service participants
    - the signing key
---
# Workspace deletion recovery request checks

## Verification Boundary

The file exercises public request handling through the local service harness. The assertion references identify the source checks for workspace deletion recovery.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The local request harness exercises the route dispatcher and the prepared database. The suite controls workflow execution, remote service participants, the signing key at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.