---
id: ADR-PFM-TNL-004
title: Durable Lifecycle Execution
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Use shared durable jobs for construction, deletion watching, purge and reset, committing each new job
  before starting its execution.
constrains:
- DOM-PFM-TNL-002
- DOM-PFM-TNL-004
- DOM-PFM-TNL-005
- SVC-PFM-TNL-tenants
- WF-PFM-TNL-001
- WF-PFM-TNL-008
- WF-PFM-TNL-009
- WF-PFM-TNL-012
- WF-PFM-TNL-013
origin: services-platform:docs/jobs.md#§2, §4 (job engine standard); services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1,
  §5.4
alternatives:
- option: Run the work inside the request
  why_not: Request-bound execution can time out after some work has committed.
- option: Start the execution inside the transaction
  why_not: External execution cannot participate in database rollback.
- option: Queue the work
  why_not: The work needs ordered steps, waits and recorded progress beyond a single message.
consequences:
- Normal submissions store their job with domain changes; provisioning retry retains a separate-commit gap.
- Job failure behavior is declared for workflow and reconciliation use.
- Shared job inspection supplies progress, events and retry lineage.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: docs/jobs.md; modules/tenants/services/provisioning/*.ts; services/deletion/*.ts;
  services/reset/*.ts.'
---

# Durable Lifecycle Execution

## Context

These operations outlast a request and need inspectable progress and recovery. Execution must not begin against records that might roll back.

## Decision

Use shared durable jobs for construction, deletion watching, purge and reset, committing each new job before starting its execution.

## Alternatives Considered

Run the work inside the request: Request-bound execution can time out after some work has committed. Start the execution inside the transaction: External execution cannot participate in database rollback. Queue the work: The work needs ordered steps, waits and recorded progress beyond a single message.

## Consequences

Normal submissions store their job with domain changes; provisioning retry retains a separate-commit gap. Job failure behavior is declared for workflow and reconciliation use. Shared job inspection supplies progress, events and retry lineage.