---
id: TST-PFM-SEC-236
title: Deletion holds database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js
implements:
  - ATS-PFM-SEC-004-06
  - ATS-PFM-SEC-004-07
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#holding
      a tenant deletion request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers
      a held request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#records
      who held it and when
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#records
      why, which is the whole point of a hold
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      the date alone: a hold stops the clock rather than moving it
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      the tenant awaiting deletion, because a hold decides nothing
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes
      a notice, because a schedule that changes silently is a schedule nobody can trust
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a second hold of the same request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a caller who is not Rhythm staff
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a hold with no reason worth reading
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a request that does not exist
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a request that has changed since the screen was drawn
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      that request scheduled after the stale refusal
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#releasing
      a tenant deletion request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers
      a scheduled request again
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#records
      who released it and when
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps
      the date it had when that date is still far off
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes
      the date out three days when the original is nearly here
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes
      it out three days even when the date has already passed
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes
      a released notice
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes
      a fresh one-day reminder against the date that now applies
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps
      the reminder the original schedule owed as well, because the slot is the kind and the date
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      to release a request that was never held
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a caller who is not Rhythm staff
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#cancelling
      a tenant deletion request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers
      a cancelled request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#records
      who called it off and why
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns
      the tenant to active
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      the tenant disabled: calling off a deletion restores nobody access
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#cancels
      a held request too
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes
      a cancelled notice
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      to cancel a request whose destruction has begun
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      that executing request exactly as it was
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      to cancel a request that is already cancelled
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses
      a caller who is not Rhythm staff
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      the tenant awaiting deletion after a refused cancel
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls the clock at the declared seams; those collaborators remain outside its live
  proof.
evidence:
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - the clock
---
# Deletion holds database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for deletion holds.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the clock at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.