--- id: TST-PFM-SEC-237 title: Request deletion database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js implements: - ATS-PFM-SEC-004-02 - ATS-PFM-SEC-004-03 - ATS-PFM-SEC-004-04 - ATS-PFM-SEC-004-11 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#requesting a tenant deletion: what the request records - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#answers a scheduled request - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#copies the tenant name and customer, so the record still reads after the tenant is gone - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#records who asked and why - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#records the thirty-day waiting period Andrew set - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#fixes the date destruction may begin, thirty days on by the calendar of the tenant zone - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#records the instant the request was made, from the execution clock - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#answers each instant in the wire form, milliseconds and a Z - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#carries the answer to what becomes of the customer - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#names no purge job, because nothing is scheduled by asking - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#moves the tenant to deletion_pending - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#leaves the tenant disabled, which it already was - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#owes the notice destruction waits for - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#owes the two reminders a thirty-day wait has room for - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#schedules the one-day reminder a day before the date - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#leaves every notice unsent, because nothing sends mail in this step - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#requesting a tenant deletion: the conditions of §5.2, one at a time - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a caller who is not Rhythm staff - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#writes no request for a caller who is not Rhythm staff - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a confirmation that does not repeat the tenant's name - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a confirmation that repeats the tenant id, which is no longer what the person types - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a reason too short to tell anybody anything - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that does not exist - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that has changed since the screen was drawn - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still being implemented, for the same reason - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is already awaiting deletion - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is being deleted - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is locked - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is somebody else parent - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a well-known tenant the whole development environment is built on - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#leaves the well-known tenant with no request of any kind - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#requesting a tenant deletion: a tenant may have only one open request - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#leaves the tenant with exactly one request after the refusal - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#allows a new request, with a new waiting period, once the first is cancelled - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#leaves the cancelled request in the history beside the new one - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#answers the new request as the open one - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#requesting a tenant deletion: how long the tenant waits - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#makes a tenant that has been in use wait the full period - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#makes a tenant that was never provisioned wait one day - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#fixes that tenant date one day on - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#gives a disposable tenant of a development environment minutes rather than days - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#records a waiting period of zero days for it, because it waits minutes - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses the disposable path in Production, where no tenant is disposable - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#honours the Production floor, refusing a configured period below fourteen days - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#owes no seven-day reminder when the whole wait is one day, but still owes the reminder destruction waits for - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#makes both of those notices due at once, or a tenant with a one-day period could never be deleted dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, the clock at the declared seams; those collaborators remain outside its live proof. evidence: - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js explicit_no_doubles: false identified_double_boundaries: - message delivery - the clock --- # Request deletion database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for request deletion. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, the clock at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.