--- id: DOM-PFM-TNL-005 title: Deletion Request realises: CON-PFM-TNL-005 product_area: platform module: tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5, §9, §13 D1–D9 (approved 2026-10-09; D1, D2, D4 and D5 Andrew 2026-10-09) implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa owned_by: SVC-PFM-TNL-tenants readable_by: [] lifecycle: STATE-PFM-TNL-004 custom_fields: none identity: The request has an independent generated identity and copied workspace facts, allowing history to outlive the workspace. attributes: - name: workspace and customer kind: reference required: true computed: false notes: Copied workspace identity, name and customer, retained without a workspace foreign key. - name: state kind: enum required: true computed: false notes: Scheduled, held, cancelled, executing, failed or completed decision standing. - name: reason kind: text required: true computed: false notes: A staff explanation from ten to two thousand characters. - name: requester and request time kind: reference required: true computed: false notes: Requester identity and request instant; no separate approver is required. - name: waiting period kind: number required: true computed: false notes: The selected policy path and day count; disposable waits use minutes with zero whole days. - name: eligible at kind: date required: true computed: false notes: Fixed eligibility at submission; release can extend it but settings do not recompute it. - name: hold, release and cancellation facts kind: collection required: false computed: false notes: Latest action actor, time and explanation for each preservation action. - name: execution facts kind: collection required: false computed: false notes: Execution start and outcome times with a safe failure explanation. - name: watcher and purge kind: reference required: false computed: false notes: Current watcher and purge identities checked by tasks before acting. - name: delete customer with its last workspace kind: enum required: true computed: false notes: A false-by-default request to remove the customer when no other workspace remains. - name: removed counts kind: collection required: false computed: false notes: Accumulated resource counts; lost batch results can understate them. - name: verification kind: collection required: false computed: false notes: Reported removable participant inventories, excluding the workspace row and unimplemented resources. - name: notices kind: collection required: true computed: false notes: Timed staff notice obligations with recorded outcomes, attempts, safe errors and provider facts. - name: verification rounds kind: number required: true computed: false notes: Persisted nonzero verification-round count; the configured third failure refuses. - name: ledger entry kind: collection required: false computed: false notes: External completion evidence for the workspace, decision, counts and backup horizon. relationships: - to: DOM-PFM-TNL-001 cardinality: many-to-one ownership: The request retains workspace identity and drives its removal standing. cross_service: false - to: DOM-PFM-TNL-003 cardinality: many-to-many ownership: The purge uses participant removal and reported inventory. cross_service: true - to: DOM-PFM-SEC-001 cardinality: many-to-one ownership: The request retains customer identity and optional final-customer removal intent. cross_service: false invariants: - id: INV-DOM-PFM-TNL-005-01 statement: The open-request index permits one scheduled, held, executing or failed request per workspace. enforced_at: - service - database provenance: observed source: services-platform:modules/tenants/db/tenant-deletion-requests.table.ts:tenant_deletion_requests_open_uidx - id: INV-DOM-PFM-TNL-005-02 statement: Admission validates disabled eligible lifecycle, protection, locking, children, exact name and reviewed version, then commits pending deletion with the decision. enforced_at: - service - database provenance: observed source: services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion, assertDeletable - id: INV-DOM-PFM-TNL-005-03 statement: Initial notices and the watcher record commit with the deletion decision. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion - id: INV-DOM-PFM-TNL-005-04 statement: Locked conditional request updates arbitrate cancellation against irreversible execution. enforced_at: - service - database provenance: observed source: services-platform:modules/tenants/services/deletion/deletion-holds.ts; services/deletion/begin-destruction.ts - id: INV-DOM-PFM-TNL-005-05 statement: Irreversible handoff requires current watcher ownership, eligibility, satisfied gating notices, deletable workspace standing and current requester authority. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction - id: INV-DOM-PFM-TNL-005-06 statement: Purge tasks check the request’s current job and deleting lifecycle, except completed-request replay can finish external work after the workspace disappears. enforced_at: - service - database provenance: observed source: services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:requirePurgeAuthority - id: INV-DOM-PFM-TNL-005-07 statement: A unique request, notice kind and due instant prevents duplicate obligation rows without ensuring one external delivery. enforced_at: - database provenance: observed source: services-platform:modules/tenants/db/tenant-deletion-notices.table.ts:tenant_deletion_notices_schedule_uidx - id: INV-DOM-PFM-TNL-005-08 statement: Failure does not reopen partially removed data; a still-executing owned request is failed, while a completed request is preserved. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/deletion/tenant-purge-failure.ts:applyTenantPurgeFailure - id: INV-DOM-PFM-TNL-005-09 statement: Retained deletion records do not depend on a workspace foreign key or workspace-scoped row policy. enforced_at: - database provenance: observed source: services-platform:db/row-level-security.ts (platform.tenant_deletion_requests, tenant_purge_jobs) - id: INV-DOM-PFM-TNL-005-10 statement: Provisioning rejects an identity retained by completed deletion evidence. enforced_at: - service provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 physical: - platform.tenant_deletion_requests - platform.tenant_deletion_notices - platform.tenant_deletion_schedule_jobs - platform.tenant_deletion_schedule_job_steps - platform.tenant_deletion_schedule_job_events - platform.tenant_purge_jobs - platform.tenant_purge_job_steps - platform.tenant_purge_job_events - deletion ledger bucket evidence: - 'services-platform at ad3f6a65: modules/tenants/services/deletion/*.ts and notices/*.ts; services/persistence/tenant-deletion-requests.ts; db/tenant-deletion-*.table.ts; db/tenant-purge-job*.table.ts; aws/resources/tenant-deletion-ledger.s3.ts; aws/resources/tenant-lifecycle-notices.ssm.ts; db/row-level-security.ts.' - 'FND-PFM-TNL-054: custom-field registration absence is not established within the permitted source scope.' --- # Deletion Request ## What It Models A deletion request records a staff decision, its reversible wait, irreversible execution and retained outcome. Its notices and jobs remain inspectable independently of the removed workspace. ## Identity and Attributes The request has an independent generated identity and copied workspace facts, allowing history to outlive the workspace. Copied workspace identity, name and customer, retained without a workspace foreign key. Scheduled, held, cancelled, executing, failed or completed decision standing. A staff explanation from ten to two thousand characters. Requester identity and request instant; no separate approver is required. The selected policy path and day count; disposable waits use minutes with zero whole days. Fixed eligibility at submission; release can extend it but settings do not recompute it. Latest action actor, time and explanation for each preservation action. Execution start and outcome times with a safe failure explanation. Current watcher and purge identities checked by tasks before acting. A false-by-default request to remove the customer when no other workspace remains. Accumulated resource counts; lost batch results can understate them. Reported removable participant inventories, excluding the workspace row and unimplemented resources. Timed staff notice obligations with recorded outcomes, attempts, safe errors and provider facts. Persisted nonzero verification-round count; the configured third failure refuses. External completion evidence for the workspace, decision, counts and backup horizon. ## Relationships The request retains workspace identity and drives its removal standing. The purge uses participant removal and reported inventory. The request retains customer identity and optional final-customer removal intent. ## Invariants The structured invariants distinguish service and database enforcement from documented obligations. The listed enforcement points bound what the workflow can rely on. ## How It Is Stored and Shared Platform’s lifecycle service owns this design object. The physical declarations identify its stored records, while shared jobs provide durable execution and inspection. ## Open Design Questions Cancellation notices can remain unsent, and finalization can stall after workspace removal or after completion without a ledger. Restore protection and those recovery windows need decisions before implementation preparation.