---
id: TST-PFM-SEC-238
title: Workspace deletion schedule database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js
implements:
  - ATS-PFM-SEC-004-05
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#the
      tenant deletion schedule job: a deletion that runs its full waiting period
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#submits
      one schedule job with the request, before anything has waited
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#sends
      the requested notice on the day of the request
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#sends
      both reminders, each on its own day, as the waiting period passes
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#tells
      the staff list and the requester, and nobody else
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#slept
      until each notice was due rather than polling, and never for a fixed duration
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#begins
      destruction at the end of the period, and the request records it
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#leaves
      the tenant deleting, not disabled, once destruction has begun
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#hands
      the destruction to a purge job of its own, rather than doing the deletion itself
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#ends
      its own watch once the destruction has begun: there is nothing left to wait for
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#the
      tenant deletion schedule job: what stops it
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#holds
      the deletion indefinitely when a notice could not be delivered, rather than destroying the
      tenant unannounced
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#ends
      quietly, without destroying anything, when the request was cancelled while it slept
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#keeps
      waiting, and destroys nothing, while the request is held
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls message delivery, workflow execution, object storage, remote service
  participants, the clock at the declared seams; those collaborators remain outside its live proof.
evidence:
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - message delivery
    - workflow execution
    - object storage
    - remote service participants
    - the clock
---
# Workspace deletion schedule database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for workspace deletion schedule.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, workflow execution, object storage, remote service participants, the clock at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.