--- id: MOD-PFM-TNL title: Workspace Lifecycle Across Applications product_area: platform module: tenant-lifecycle revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa repositories: - name: services-platform paths: - modules/tenants/** - docs/tenants/** - docs/standards/baseline-configuration.md - docs/data-jobs/tenant-reset.md - docs/hq/rhythm-hq-plan.md - docs/proposals/rhythm-data-job-engine-plan.md - docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md - aws/platform.service.ts - name: services-crm paths: - modules/tenant-lifecycle - name: services-commerce paths: - modules/tenant-lifecycle - name: services-committees paths: - modules/tenant-lifecycle - name: services-membership paths: - modules/tenant-lifecycle - name: services-submissions paths: - modules/tenant-lifecycle - name: services-websites paths: - modules/tenant-lifecycle - name: services-marketing paths: - modules/tenant-lifecycle owns: - >- Workspace lifecycle state, first opening time, load attribution, disposable designation and derived availability. - >- Provisioning submission and build records, their progress, notices, alerts and stranded-workspace repair. - >- Participant contracts, application registration, resource ownership registers and default seed ledgers. - Initialization and the participant baseline reconciliation contract. - 'Loading entry, post-load activation and reset coordination.' - >- Deletion decisions, internal notice obligations, waiting schedules, purge coordination and retained deletion history. - >- Ledger-based restore reapplication and operational leftover or long-disabled reporting. - >- Application lifecycle entry points and their participant export contributions. does_not_own: - record: >- Ordinary workspace fields, customer records, HQ workspace browsing, shortcuts and application administration. owner: MOD-PFM-SEC - record: >- People, roles, assignments, invitations, standing staff grants and portal identity ownership. owner: MOD-PFM-SEC - record: 'Shared durable execution, reconciliation and job inspection surfaces.' owner: MOD-PFM-OPS - record: 'Data Run coordination, upload handling and the import engine.' owner: MOD-PFM-DJE - record: 'Overall data-export execution, scheduling, packaging and delivery.' owner: MOD-PFM-QRY - record: >- Sender identity ownership and general notification or communication delivery. owner: MOD-PFM-NOT - record: Licensing and application-availability entitlements. owner: MOD-PFM-OPS - record: Application business records addressed by lifecycle participants. owner: >- MOD-CRM-ENT, MOD-COM-ORD, MOD-CMT-CMT, MOD-MBR-MEM, MOD-SUB-SUB, MOD-WEB-WEB, MOD-MKT-MKT and the other owning modules - record: >- Accounting participant implementations, whose repository is outside this examination. owner: 'MOD-ACC-BKS and MOD-BIL-BIL (services-accounting, not read here)' hosted_screens: [] supersedes: [] evidence: - >- Pinned services-platform: lifecycle route declarations, services, persistence and table definitions under modules/tenants; lifecycle and HQ approved plans; baseline standard decision D-48; reset and data-job records. - >- Pinned services-crm, services-commerce, services-committees, services-membership, services-submissions, services-websites and services-marketing: lifecycle entry points, participant declarations, seed and purge helpers and module test inventories. - >- Coverage: 17/17 lifecycle HTTP operations; 8/8 lifecycle protocol operation names; 20/20 lifecycle table definitions; 10/10 referenced lifecycle permission keys; 4/4 lifecycle state-machine definitions. These ratios establish specification reachability, not executed behavior. - >- Acceptance bindings name 65/129 module test files, leaving 64 unbound files listed by path in reports/EXAMINATION-2026-10-22.md and tracked by FND-PFM-TNL-033. - >- Console implementation coverage is unmeasured: no console repository or page path is registered for this module. FND-PFM-TNL-020 and OQ-PFM-TNL-001 retain that boundary. coverage_catalog: > The inventory links pinned declarations to planning capabilities. Reachability does not imply that an application was deployed or that a bound test was executed. ### Operations by capability | Operation | Capability | |---|---| | `createTenant` | `CAP-PFM-TNL-001` | | `getTenantProvisioning` | `CAP-PFM-TNL-003` | | `retryTenantProvisioning` | `CAP-PFM-TNL-003` | | `initializeTenant` | `CAP-PFM-TNL-009` | | `deleteTenant` | `CAP-PFM-TNL-018` | | `requestTenantDeletion` | `CAP-PFM-TNL-013` | | `listTenantDeletionRequests` | `CAP-PFM-TNL-014` | | `getTenantDeletionRequest` | `CAP-PFM-TNL-014` | | `holdTenantDeletionRequest` | `CAP-PFM-TNL-014` | | `releaseTenantDeletionRequest` | `CAP-PFM-TNL-014` | | `cancelTenantDeletionRequest` | `CAP-PFM-TNL-014` | | `resumeTenantDeletionSchedule` | `CAP-PFM-TNL-016` | | `retryTenantPurge` | `CAP-PFM-TNL-017` | | `enterHqTenantLoading` | `CAP-PFM-TNL-011` | | `activateHqTenant` | `CAP-PFM-TNL-011` | | `resetHqTenant` | `CAP-PFM-TNL-012` | | `getHqTenantReset` | `CAP-PFM-TNL-012` | ### Lifecycle function operations by capability | Operation | Capability | |---|---| | `describe` | `CAP-PFM-TNL-007` | | `provision` | `CAP-PFM-TNL-002` | | `verifyProvisioned` | `CAP-PFM-TNL-002` | | `purge` | `CAP-PFM-TNL-017` | | `inventory` | `CAP-PFM-TNL-017` | | `reset` | `CAP-PFM-TNL-012` | | `initialize` | `CAP-PFM-TNL-009` | | `export` | `CAP-PFM-TNL-010` | ### Tables by capability | Table | Capabilities | |---|---| | tenants.table.ts (lifecycle state, activation instant, load record, disposable flag) | `CAP-PFM-TNL-006`, `CAP-PFM-TNL-005`, `CAP-PFM-TNL-011` | | tenant-provisioning-jobs.table.ts | `CAP-PFM-TNL-001`, `CAP-PFM-TNL-003` | | tenant-provisioning-job-steps.table.ts | `CAP-PFM-TNL-002`, `CAP-PFM-TNL-003` | | tenant-provisioning-job-events.table.ts | `CAP-PFM-TNL-003` | | tenant-deletion-requests.table.ts | `CAP-PFM-TNL-013`, `CAP-PFM-TNL-014`, `CAP-PFM-TNL-018` | | tenant-deletion-notices.table.ts | `CAP-PFM-TNL-015` | | tenant-deletion-schedule-jobs.table.ts | `CAP-PFM-TNL-016` | | tenant-deletion-schedule-job-steps.table.ts | `CAP-PFM-TNL-016` | | tenant-deletion-schedule-job-events.table.ts | `CAP-PFM-TNL-016` | | tenant-purge-jobs.table.ts | `CAP-PFM-TNL-017` | | tenant-purge-job-steps.table.ts | `CAP-PFM-TNL-017` | | tenant-purge-job-events.table.ts | `CAP-PFM-TNL-017` | | tenant-reset-jobs.table.ts | `CAP-PFM-TNL-012` | | tenant-reset-job-steps.table.ts | `CAP-PFM-TNL-012` | | tenant-reset-job-events.table.ts | `CAP-PFM-TNL-012` | | tenant-resources.table.ts | `CAP-PFM-TNL-007` | | tenant-seed-applications.table.ts | `CAP-PFM-TNL-008` | | services-crm tenant-seed-applications.table.ts | `CAP-PFM-TNL-008` | | services-committees tenant-seed-applications.table.ts | `CAP-PFM-TNL-008` | | services-membership tenant-seed-applications.table.ts | `CAP-PFM-TNL-008` | ### Permission keys by capability | Permission key | Capabilities | |---|---| | `hq.tenants.provision` | `CAP-PFM-TNL-001`, `CAP-PFM-TNL-003`, `CAP-PFM-TNL-009` | | `hq.tenants.read` | `CAP-PFM-TNL-003` | | `hq.tenants.activate` | `CAP-PFM-TNL-011` | | `hq.tenants.update` | `CAP-PFM-TNL-018` | | `hq.data-runs.manage` | `CAP-PFM-TNL-011`, `CAP-PFM-TNL-012` | | `platform.tenants.deletion-request` | `CAP-PFM-TNL-013`, `CAP-PFM-TNL-016`, `CAP-PFM-TNL-017` | | `platform.tenants.deletion-hold` | `CAP-PFM-TNL-014` | | `platform.tenants.deletion-cancel` | `CAP-PFM-TNL-014` | | `platform.tenants.deletion-read` | `CAP-PFM-TNL-014`, `CAP-PFM-TNL-018` | | `platform.tenants.manage-status` | `CAP-PFM-TNL-006` | ### Jobs, schedules and resources by capability | Item | Capabilities | |---|---| | state machine platform-tenant-provisioning | `CAP-PFM-TNL-002` | | state machine platform-tenant-deletion-schedule | `CAP-PFM-TNL-016` | | state machine platform-tenant-purge | `CAP-PFM-TNL-017` | | state machine platform-tenant-reset | `CAP-PFM-TNL-012` | | stranded-provisioning repair after each reconciler pass | `CAP-PFM-TNL-003` | | failed-notice alarm | `CAP-PFM-TNL-015` | | notify-to parameter | `CAP-PFM-TNL-015` | | deletion ledger bucket | `CAP-PFM-TNL-018` | | scripts long-disabled, orphans, reapply-deletions | `CAP-PFM-TNL-013`, `CAP-PFM-TNL-018` | | CRM baseline reconciliation on deployment | `CAP-PFM-TNL-009` | | seven applications’ lifecycle functions | `CAP-PFM-TNL-007` | ### Operations named for MOD-PFM-SEC `listTenants`, `getTenant`, `updateTenant`, `patchTenant`, `setTenantHubspotCompany`, `getDefaultTenantForCustomer`, `listByCustomerId`, `listTenantsByParentId`, `listHqTenants`, `getHqTenant`, `getHqTenantEmailSender`, `patchHqTenant`, `listTenantApplicationsForTenant`, `listMyHqTenantShortcuts`, `pinMyHqTenantShortcut`, `unpinMyHqTenantShortcut`, `recordMyHqTenantShortcutOpened`.### Operations named for MOD-PFM-SEC `listTenants`, `getTenant`, `updateTenant`, `patchTenant`, `setTenantHubspotCompany`, `getDefaultTenantForCustomer`, `listByCustomerId`, `listTenantsByParentId`, `listHqTenants`, `getHqTenant`, `getHqTenantEmailSender`, `patchHqTenant`, `listTenantApplicationsForTenant`, `listMyHqTenantShortcuts`, `pinMyHqTenantShortcut`, `unpinMyHqTenantShortcut`, `recordMyHqTenantShortcutOpened`. --- # Workspace Lifecycle Across Applications ## Purpose This module coordinates the progression from a requested workspace through construction, initial loading and deliberate removal. Staff inspect results, recover interrupted work and make the decisions that change availability. Participants account for application resources, with recorded gaps limiting claims of complete cross-application removal. ## Boundary Lifecycle orchestration owns the state, decisions and participant contracts described here. Workspace administration retains ordinary customer and access records; jobs retain shared durable execution; Data Runs own the import engine; exports own whole-package execution and delivery; communications own general sending. Application teams retain their business records and supply lifecycle operations for them. Console implementation remains outside the registered read scope. ## Features | Feature | Concepts | Capabilities | Rules | Journeys | |---|---|---|---|---| | `FEAT-PFM-TNL-01` — New Workspace Construction | 1 | 4 | 36 | 2 | | `FEAT-PFM-TNL-02` — Workspace Readiness and Access | 1 | 2 | 16 | 0 | | `FEAT-PFM-TNL-03` — Application Lifecycle Responsibilities | 1 | 4 | 31 | 1 | | `FEAT-PFM-TNL-04` — Initial Import Recovery | 1 | 2 | 17 | 1 | | `FEAT-PFM-TNL-05` — Reversible Deletion Decisions | 1 | 3 | 28 | 0 | | `FEAT-PFM-TNL-06` — Irreversible Removal and History | 0 | 3 | 31 | 1 | The pinned inventory reaches seventeen lifecycle HTTP operations, eight protocol operation names, twenty lifecycle table definitions and ten lifecycle permission keys. Acceptance bindings cover sixty-five of one hundred twenty-nine module test files; the report names the remaining files. Console coverage is unmeasured. ## Capabilities | Id | Feature | Title | Product Intent | Implementation Evidence | |---|---|---|---|---| | `CAP-PFM-TNL-001` | `FEAT-PFM-TNL-01` | Request a complete customer workspace | proposed | observed | | `CAP-PFM-TNL-002` | `FEAT-PFM-TNL-01` | Open a workspace after its applications are ready | proposed | observed | | `CAP-PFM-TNL-003` | `FEAT-PFM-TNL-01` | Understand and recover a workspace build | confirmed | observed | | `CAP-PFM-TNL-004` | `FEAT-PFM-TNL-01` | Prepare the customer’s first access and sender | proposed | observed | | `CAP-PFM-TNL-005` | `FEAT-PFM-TNL-02` | Apply workspace availability consistently | proposed | observed | | `CAP-PFM-TNL-006` | `FEAT-PFM-TNL-02` | Preserve valid workspace lifecycle states | proposed | observed | | `CAP-PFM-TNL-007` | `FEAT-PFM-TNL-03` | Account for each application’s lifecycle responsibilities | proposed | observed | | `CAP-PFM-TNL-008` | `FEAT-PFM-TNL-03` | Apply defaults without undoing customer choices | confirmed | observed | | `CAP-PFM-TNL-009` | `FEAT-PFM-TNL-03` | Maintain the baseline of existing workspaces | proposed | partially-observed | | `CAP-PFM-TNL-010` | `FEAT-PFM-TNL-03` | Supply application data for workspace exports | proposed | observed | | `CAP-PFM-TNL-011` | `FEAT-PFM-TNL-04` | Control the initial import and subsequent opening | confirmed | observed | | `CAP-PFM-TNL-012` | `FEAT-PFM-TNL-04` | Recover an incorrect initial import | proposed | partially-observed | | `CAP-PFM-TNL-013` | `FEAT-PFM-TNL-05` | Schedule deliberate workspace deletion | confirmed | observed | | `CAP-PFM-TNL-014` | `FEAT-PFM-TNL-05` | Pause or cancel deletion while preservation remains possible | confirmed | observed | | `CAP-PFM-TNL-015` | `FEAT-PFM-TNL-05` | Keep deletion decisions visible to staff | proposed | observed | | `CAP-PFM-TNL-016` | `FEAT-PFM-TNL-06` | Revalidate the irreversible deletion decision | confirmed | observed | | `CAP-PFM-TNL-017` | `FEAT-PFM-TNL-06` | Remove declared workspace resources and verify the result | confirmed | observed | | `CAP-PFM-TNL-018` | `FEAT-PFM-TNL-06` | Retain deletion evidence and prevent identifier reuse | confirmed | partially-observed | ## Journeys | Id | Feature | Title | E2E Policy | |---|---|---|---| | `JNY-PFM-TNL-001` | `FEAT-PFM-TNL-01` | Staff establish the customer’s first workspace | required | | `JNY-PFM-TNL-002` | `FEAT-PFM-TNL-01` | Staff finish an interrupted workspace build | required | | `JNY-PFM-TNL-003` | `FEAT-PFM-TNL-04` | Staff correct an import and approve opening | required | | `JNY-PFM-TNL-004` | `FEAT-PFM-TNL-06` | Staff complete a departed customer’s deletion | required | | `JNY-PFM-TNL-005` | `FEAT-PFM-TNL-03` | CRM delivers new defaults to existing workspaces | none |