---
id: TST-PFM-SEC-241
title: Workspace purge database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js
implements: []
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#the
      tenant purge job: a tenant destroyed, measured rather than reported
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#purges
      accounting.configuration before the tenant row it depends on, in reverse dependency order
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#purges
      accounting.transactions before accounting.configuration, which it depends on
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#asks
      Accounting for another batch until it answers done, and Accounting holds nothing of the tenant
      afterwards
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#purges
      Accounting’s transactions a batch at a time until done, and Accounting holds none of the
      tenant’s afterwards
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs
      the purge to the end and succeeds
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#removes
      the tenant row itself
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves
      no row of the tenant in any table a participant declares
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#empties
      the tables that hold more rows than one batch, rather than stopping at the first reference
      that refuses
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#keeps
      the deletion’s own job rows, which are the record of what was done
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#clears
      every folder of the uploads bucket the tenant’s bytes sit under
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#clears
      every VERSION of the tenant’s data-job objects, under all three of their prefixes
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#clears
      every VERSION of the tenant’s LLM evidence, leaving its prefix empty
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves
      LLM evidence under a folder whose name merely begins like the tenant’s
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves
      a data-job folder whose name merely begins like the tenant’s, as the uploads bucket’s does
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves
      a folder whose name merely begins like the tenant’s, which is what the trailing slash is for
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves
      the other tenant of the same customer exactly as it was
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#keeps
      the customer, because the deleted tenant was not its last
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#asks
      a participant for another batch until it answers done, rather than looping inside one
      invocation
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#cuts
      off cached access before it removes anything
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs
      one step per participant, in the planned order, and completes every one of them
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#checks
      that nothing is left before it finalizes, and asks every participant to count
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#records
      on the request what was removed, and the counts it verified
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#writes
      the permanent deletion record outside the database, keyed by the tenant
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#tells
      the people the plan owes a last notice to
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#the
      tenant purge job: a remote participant Platform switches off is never described or asked
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#describes
      CRM, the enabled remote service (the premise: the instrument records a description)
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#neither
      describes nor asks Accounting while its participants are switched off
  - provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#refuses
      the purge as planned for other participants rather than skipping one
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls message delivery, workflow execution, object storage, remote service
  participants, the clock at the declared seams; those collaborators remain outside its live proof.
evidence:
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  The file has no scenario binding established by this examination. Its executable checks remain
  registered without assigning them broader acceptance coverage.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - message delivery
    - workflow execution
    - object storage
    - remote service participants
    - the clock
---
# Workspace purge database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for workspace purge.

## What This Suite Proves

The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls message delivery, workflow execution, object storage, remote service participants, the clock at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.