---
id: ADR-PFM-TNL-010
title: Batched Removal and Declared-Resource Verification
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf
  services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c
  services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa
decision: Remove resources in participant batches, recheck purge ownership and deleting standing, verify empty removable
  inventories within the bounded sweep policy and recover forward after failure.
constrains:
- DOM-PFM-TNL-005
- DOM-PFM-TNL-003
- WF-PFM-TNL-013
- WF-PFM-TNL-014
- SVC-PFM-TNL-tenants
- SVC-PFM-TNL-crm-tenant-lifecycle
- SVC-PFM-TNL-commerce-tenant-lifecycle
- SVC-PFM-TNL-committees-tenant-lifecycle
- SVC-PFM-TNL-membership-tenant-lifecycle
- SVC-PFM-TNL-submissions-tenant-lifecycle
- SVC-PFM-TNL-websites-tenant-lifecycle
- SVC-PFM-TNL-marketing-tenant-lifecycle
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9, §6.2, §6.6 (approved 2026-10-09)
alternatives:
- option: One transaction per participant or per workspace
  why_not: An oversized transaction would retain locks and lose progress on timeout.
- option: Restore a partly destroyed workspace on failure
  why_not: Failure recovery cannot reconstruct resources already destroyed.
- option: Trust each participant's done
  why_not: A participant’s completion answer is insufficient without the declared-resource inventory.
consequences:
- Linked retry carries completed work while revisiting unfinished removal.
- Superseded executions refuse further guarded work.
- Participant commits precede count recording, so lost results can understate totals.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{tenant-purge-workflow, tenant-purge-operations,
  tenant-purge-failure}.ts; services/lifecycle/purge-batches.ts.'
---

# Batched Removal and Declared-Resource Verification

## Context

Long removal needs bounded transactions and an independent check of declared leftovers. A partly removed workspace cannot be safely reopened.

## Decision

Remove resources in participant batches, recheck purge ownership and deleting standing, verify empty removable inventories within the bounded sweep policy and recover forward after failure.

## Alternatives Considered

One transaction per participant or per workspace: An oversized transaction would retain locks and lose progress on timeout. Restore a partly destroyed workspace on failure: Failure recovery cannot reconstruct resources already destroyed. Trust each participant's done: A participant’s completion answer is insufficient without the declared-resource inventory.

## Consequences

Linked retry carries completed work while revisiting unfinished removal. Superseded executions refuse further guarded work. Participant commits precede count recording, so lost results can understate totals.