--- id: TST-PFM-SEC-235 title: Begin destruction database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js implements: - ATS-PFM-SEC-004-05 - ATS-PFM-SEC-004-08 - ATS-PFM-SEC-004-09 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#beginning a tenant destruction: when every condition is met - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#answers that destruction began - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#answers the request as it now is - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#records when destruction began - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#moves the tenant to deleting - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves the tenant disabled, as the cross-axis rule requires - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#owes an executing notice, so somebody is told the point of no return was passed - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the purge job it submitted in the same transaction, so the point of no return and its destruction commit together - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends quietly when the same execution asks again, because the request is no longer scheduled - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#beginning a tenant destruction: the conditions that make it wait - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits one millisecond before the date - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#begins at the date itself, which is the other side of that millisecond - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits while a notice destruction waits for has not been sent - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the notices it is waiting for - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves the tenant awaiting deletion while it waits for a notice - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits while the request is held - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#says why it is held, so the schedule job logs something a person can act on - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits when the tenant gained a child during the waiting period - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits when the tenant was locked during the waiting period - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits when the person who asked no longer holds the permission to ask - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#records why it held it - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves the tenant awaiting deletion through every one of those waits - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#beginning a tenant destruction: the conditions that end it - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends when there is no such request - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends when the request was cancelled while the job slept - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends when another execution now owns the request, which is what a resume looks like - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the execution that superseded it - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#touches nothing when it ends: the tenant is still awaiting deletion - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends when the tenant is already gone - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#beginning a tenant destruction: a cancel racing it on another connection - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#lets exactly one of the two win, every round - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses the cancel as already executing in every round destruction won - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#tells destruction the request was cancelled in every round the cancel won - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves every request in a state that matches who won - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves every tenant in a lifecycle state that matches who won - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#leaves every tenant with exactly one request, so no round wrote a second one - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#races both ways across the rounds, so the suite is not quietly proving one order every time - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#beginning a tenant destruction: refusing a cancel once it has begun - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses a cancel that arrives after the point of no return dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the clock at the declared seams; those collaborators remain outside its live proof. evidence: - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js explicit_no_doubles: false identified_double_boundaries: - the clock --- # Begin destruction database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for begin destruction. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the clock at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.