---
id: ADR-PFM-TNL-002
title: Controlled Lifecycle Writes
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Keep lifecycle changes behind workflow operations, use a successor table for ordinary state moves and
  enforce required business-standing combinations in the database.
constrains:
- DOM-PFM-TNL-001
- STATE-PFM-TNL-001
- SVC-PFM-TNL-tenants
- WF-PFM-TNL-002
- WF-PFM-TNL-007
- WF-PFM-TNL-009
- WF-PFM-TNL-012
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.2 (approved 2026-10-09)
alternatives:
- option: Let staff set lifecycle state through the workspace update
  why_not: Direct field edits could open a workspace before readiness or skip deletion safeguards.
- option: Rely on service checks alone
  why_not: Database constraints also protect against writers outside the normal service path.
consequences:
- Client inputs cannot choose lifecycle state or first provisioning activation.
- Restore recovery uses a separately constrained forced move.
- Repeated workflow work can converge, although generic state writes still update bookkeeping.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/lifecycle/lifecycle-transitions.ts; db/tenants.table.ts;
  services/persistence/tenants.ts.'
---

# Controlled Lifecycle Writes

## Context

Lifecycle state controls whether a workspace is ready or being removed. Treating it as an editable administrative field would bypass the work that justifies a change.

## Decision

Keep lifecycle changes behind workflow operations, use a successor table for ordinary state moves and enforce required business-standing combinations in the database.

## Alternatives Considered

Let staff set lifecycle state through the workspace update: Direct field edits could open a workspace before readiness or skip deletion safeguards. Rely on service checks alone: Database constraints also protect against writers outside the normal service path.

## Consequences

Client inputs cannot choose lifecycle state or first provisioning activation. Restore recovery uses a separately constrained forced move. Repeated workflow work can converge, although generic state writes still update bookkeeping.