--- id: DOM-PFM-TNL-001 title: Workspace Lifecycle realises: CON-PFM-TNL-001 product_area: platform module: tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.2 Transitions, §5.6 The access gate (approved 2026-10-09); services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5, Andrew 2026-10-11) implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa owned_by: SVC-PFM-TNL-tenants readable_by: - SVC-PFM-TNL-crm-tenant-lifecycle - SVC-PFM-TNL-commerce-tenant-lifecycle - SVC-PFM-TNL-committees-tenant-lifecycle - SVC-PFM-TNL-membership-tenant-lifecycle - SVC-PFM-TNL-submissions-tenant-lifecycle - SVC-PFM-TNL-websites-tenant-lifecycle - SVC-PFM-TNL-marketing-tenant-lifecycle - SVC-PFM-SEC-tenants lifecycle: STATE-PFM-TNL-001 custom_fields: none identity: This object uses the workspace’s permanent identifier and has no independent record identity. attributes: - name: lifecycle state kind: enum required: true computed: false notes: System-owned construction, active, loading or removal standing; direct creation defaults active. - name: business status (read) kind: enum required: true computed: false notes: Administrative live, implementation or disabled standing, constrained against loading and removal lifecycle. - name: first activation time kind: date required: false computed: false notes: The first provisioning activation stamp; absence selects unopened treatment unless disposable policy takes precedence. - name: loading entered at kind: date required: false computed: false notes: Latest load-opening time, required while loading and retained by activation. - name: loading entered by kind: reference required: false computed: false notes: Staff actor for the latest opening, required while loading. - name: loading reason kind: text required: false computed: false notes: An optional opening explanation bounded to five hundred characters. - name: disposable kind: enum required: true computed: false notes: A false-by-default test designation for accelerated non-Production removal. - name: availability kind: computed required: true computed: true notes: A request-specific available, unavailable or read-only result from cached workspace facts and route context. - name: unavailability reason kind: computed required: false computed: true notes: The local diagnostic reason for a uniform unavailable response. relationships: - to: DOM-PFM-SEC-002 cardinality: one-to-one ownership: Workspace administration owns the shared row; lifecycle owns the system facts. cross_service: false - to: DOM-PFM-TNL-002 cardinality: one-to-many ownership: The attempt retains its workspace reference. cross_service: false - to: DOM-PFM-TNL-004 cardinality: one-to-one ownership: Loading facts occupy the same workspace record. cross_service: false - to: DOM-PFM-TNL-005 cardinality: one-to-many ownership: The request retains copied identity without depending on the workspace row. cross_service: false invariants: - id: INV-DOM-PFM-TNL-001-01 statement: Ordinary lifecycle changes use the locked row and successor table; restore reapplication separately forces deleting, and accepted same-state writes can still update bookkeeping. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:assertLifecycleTransition; services/persistence/tenants.ts:forceTenantDeletingAfterRestore - id: INV-DOM-PFM-TNL-001-02 statement: The ordinary successor table offers no move out of deleting. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:SUCCESSORS - id: INV-DOM-PFM-TNL-001-03 statement: Loading requires implementation standing, and both removal states require disabled standing. enforced_at: - database provenance: observed source: services-platform:modules/tenants/db/tenants.table.ts:tenants_deletion_pending_status_check, tenants_deleting_status_check, tenants_loading_status_check - id: INV-DOM-PFM-TNL-001-04 statement: Loading requires an opening actor and timestamp. enforced_at: - database provenance: observed source: services-platform:modules/tenants/db/tenants.table.ts:tenants_loading_entered_check - id: INV-DOM-PFM-TNL-001-05 statement: Client record input cannot select lifecycle or first provisioning activation. enforced_at: - api - service provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.2 No API sets lifecycle_state - id: INV-DOM-PFM-TNL-001-06 statement: The availability rule admits ordinary active non-disabled requests, rejects missing workspaces and makes deleting read-only for authorized staff system routes. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf - id: INV-DOM-PFM-TNL-001-07 statement: Loading permits authorized data-job routes for callers outside the staff system exception. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/access/tenant-availability.ts:isDataJobRoute - id: INV-DOM-PFM-TNL-001-08 statement: The documented policy excludes disposable standing from Production. enforced_at: - service provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.3 Disposable test tenants physical: - platform.tenants evidence: - 'services-platform at ad3f6a65: modules/tenants/services/lifecycle/lifecycle-transitions.ts; services/access/tenant-availability.ts; services/persistence/tenants.ts (setTenantLifecycleState, enterTenantLoading, activateLoadedTenant, activateProvisionedTenant, failTenantProvisioning, listOperationalTenantIds); db/tenants.table.ts.' - 'services-crm, services-commerce, services-submissions, services-websites at their pinned commits: modules/tenant-lifecycle/services/lifecycle/tenant-availability.ts and their reads of the workspace record.' - 'FND-PFM-TNL-054: custom-field registration absence is not established within the permitted source scope.' --- # Workspace Lifecycle ## What It Models Workspace readiness and removal standing are system facts on the administrative workspace record. They control request availability separately from the customer’s business standing. ## Identity and Attributes This object uses the workspace’s permanent identifier and has no independent record identity. System-owned construction, active, loading or removal standing; direct creation defaults active. Administrative live, implementation or disabled standing, constrained against loading and removal lifecycle. The first provisioning activation stamp; absence selects unopened treatment unless disposable policy takes precedence. Latest load-opening time, required while loading and retained by activation. Staff actor for the latest opening, required while loading. An optional opening explanation bounded to five hundred characters. A false-by-default test designation for accelerated non-Production removal. A request-specific available, unavailable or read-only result from cached workspace facts and route context. The local diagnostic reason for a uniform unavailable response. ## Relationships Workspace administration owns the shared row; lifecycle owns the system facts. The attempt retains its workspace reference. Loading facts occupy the same workspace record. The request retains copied identity without depending on the workspace row. ## Invariants The structured invariants distinguish service and database enforcement from documented obligations. The listed enforcement points bound what the workflow can rely on. ## How It Is Stored and Shared Platform’s lifecycle service owns this design object. The physical declarations identify its stored records, while shared jobs provide durable execution and inspection. ## Open Design Questions Availability copies and HQ writes outside the gate limit a universal access claim. Restore reapplication remains necessary because the gate does not read the external deletion ledger.