--- id: TST-PFM-SEC-240 title: Workspace purge recovery database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js implements: - ATS-PFM-SEC-004-11 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#the tenant purge job: what stops it, and how it is recovered - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#fails the request with the participant’s own reason when a participant is blocked - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#leaves a tenant whose purge failed deleting, so nothing can reach it while it is half destroyed - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#tells the people a deletion that failed was not completed - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#does not run the steps a failed purge had already completed when it is retried - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#leaves a retried request untouched when the purge it replaced records its failure afterwards - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#leaves a retried request untouched when the reconciler settles the purge it replaced - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#runs every participant again when a row appears after one of them finished, and finishes when it is gone - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to finish, with the counts, when something keeps writing to the tenant - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#deletes the customer with its last tenant when the request asked for it - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#never touches the catalog rows the product owns, whatever a customer purge removes - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to create a tenant again under the id of one that was deleted - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#the tenant purge definer functions: what the database refuses, whoever asks - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses a purge that names no tenant - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses a purge of a tenant other than the one the session is in - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses a purge of a tenant that is neither being deleted nor being loaded - provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses a batch size no purge would ask for, even of a tenant it would otherwise purge dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, workflow execution, object storage, remote service participants, the clock at the declared seams; those collaborators remain outside its live proof. evidence: - >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js explicit_no_doubles: false identified_double_boundaries: - message delivery - workflow execution - object storage - remote service participants - the clock --- # Workspace purge recovery database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for workspace purge recovery. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, workflow execution, object storage, remote service participants, the clock at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.