--- id: ATS-PFM-TNL-014 scope: CAP-PFM-TNL-014 product_area: platform module: tenant-lifecycle revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa rhythm-v2-docs: d318a948692343e2f0a7ecc2e11c50db179a8c95 scenarios: - id: ATS-PFM-TNL-014-01 title: Customer context cannot administer deletion level: api proves: - BR-CAP-PFM-TNL-014-01 preconditions: A deletion request remains open. steps: 'Attempt hold, release, cancellation, read and list with customer authority.' expected: Every call refuses without changing the request. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not hold a deletion request - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not release a deletion request - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not cancel a deletion request - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not read a deletion request - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not list deletion requests - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#leaves the request exactly as it was after all of those refusals - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a caller who is not Rhythm staff provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not hold a deletion request category: permission action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not hold a deletion request assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not hold a deletion request binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-014-02 title: Action inputs must be accountable and current level: api proves: - BR-CAP-PFM-TNL-014-02 preconditions: Staff target a scheduled request. steps: Hold with an invalid reason and a stale version. expected: Both attempts leave it scheduled. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a hold with no reason worth reading - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a request that has changed since the screen was drawn - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves that request scheduled after the stale refusal - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#refuses an action at a stale version as 409 provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a hold with no reason worth reading category: validation action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a hold with no reason worth reading assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a hold with no reason worth reading binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-014-03 title: Holding preserves eligibility level: api proves: - BR-CAP-PFM-TNL-014-03 preconditions: The request is scheduled. steps: 'Hold it with a reason, then repeat hold.' expected: The first records the pause and actor without moving the date; repetition refuses. negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a held request - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#records why, which is the whole point of a hold - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the date alone: a hold stops the clock rather than moving it - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant awaiting deletion, because a hold decides nothing - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a second hold of the same request - TST-PFM-TNL-062 provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a held request category: transition action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a held request assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a held request binding_note: >- All cited checks for this scenario occur in the registered file. The link establishes inspected executable source rather than a passing run. - id: ATS-PFM-TNL-014-04 title: Release leaves a minimum review interval level: api proves: - BR-CAP-PFM-TNL-014-04 preconditions: 'Held fixtures have distant, imminent and elapsed dates.' steps: Release each fixture. expected: 'The distant date persists and others receive three days, with a new final reminder.' negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps the date it had when that date is still far off - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes the date out three days when the original is nearly here - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes it out three days even when the date has already passed - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes a fresh one-day reminder against the date that now applies - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to release a request that was never held - TST-PFM-TNL-062 provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps the date it had when that date is still far off category: boundary action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps the date it had when that date is still far off assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps the date it had when that date is still far off binding_note: >- All cited checks for this scenario occur in the registered file. The link establishes inspected executable source rather than a passing run. - id: ATS-PFM-TNL-014-05 title: Cancellation preserves disabled status level: api proves: - BR-CAP-PFM-TNL-014-05 preconditions: One request is scheduled and another held. steps: Cancel both. expected: Both decisions are retained as cancelled and their workspaces are active but disabled. negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a cancelled request - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns the tenant to active - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#cancels a held request too - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a cancelled request category: transition action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a cancelled request assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a cancelled request binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-014-06 title: Execution prevents cancellation level: api proves: - BR-CAP-PFM-TNL-014-06 preconditions: The request has passed into executing. steps: Attempt to cancel it. expected: The response reports irreversible execution and preserves request state. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves that executing request exactly as it was - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses a cancel that arrives after the point of no return - >- services-platform:modules/tenants/tests/integration/services/persistence/tenant-deletion-requests.integration.spec.js#matches nothing once the request is executing, which is the point of no return provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun category: edge action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-014-07 title: Cancellation does not imply delivery of its notice category: interaction level: api proves: - BR-CAP-PFM-TNL-014-05 interacts_with: - CAP-PFM-TNL-015 - CAP-PFM-TNL-013 - CAP-PFM-TNL-016 preconditions: A reversible deletion request has its normal watcher sleeping. steps: 'Cancel it, inspect the stored cancellation obligation and let the ordinary watcher revisit the request.' expected: >- The workspace remains disabled with active lifecycle; the obligation exists, but the ordinary watcher ends on cancelled standing without sending that cancellation notice. negative: true data_needs: >- Create a separate run-owned workspace for each decision branch and an unaffected comparison workspace. Use a controlled clock, paused task or injected fault at the boundary named in the scenario. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-015-tell-rhythm-staff-about-every-step-of-a-deletion.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-013-ask-for-a-workspace-to-be-deleted-after-a-waiting-period.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-016-begin-destruction-only-when-every-safeguard-still-holds.md action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-015-tell-rhythm-staff-about-every-step-of-a-deletion.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-013-ask-for-a-workspace-to-be-deleted-after-a-waiting-period.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-016-begin-destruction-only-when-every-safeguard-still-holds.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-015-tell-rhythm-staff-about-every-step-of-a-deletion.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-013-ask-for-a-workspace-to-be-deleted-after-a-waiting-period.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-016-begin-destruction-only-when-every-safeguard-still-holds.md evidence: - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not hold a deletion request - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a hold with no reason worth reading - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a held request - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#keeps the date it had when that date is still far off - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#answers a cancelled request - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun - >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-015-tell-rhythm-staff-about-every-step-of-a-deletion.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-013-ask-for-a-workspace-to-be-deleted-after-a-waiting-period.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-016-begin-destruction-only-when-every-safeguard-still-holds.md coverage: rule: 'gap: FND-PFM-TNL-079' transition: 'gap: FND-PFM-TNL-079' validation: covered permission: covered edge: covered failure: 'gap: FND-PFM-TNL-079' boundary: covered concurrency: 'gap: FND-PFM-TNL-079' invariant: 'gap: FND-PFM-TNL-079' interaction: covered coverage_notes: transition: >- The listed scenarios sample lifecycle changes. Complete transition, guard and side-effect proof is still owed for the state models named in the coverage finding. interaction: >- The added interaction is proposed. Related capabilities not included in that scenario remain named in the coverage finding. transition_obligations: - state_model: STATE-PFM-TNL-001 transition_n: 1 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateProvisionedTenant' - state_model: STATE-PFM-TNL-001 transition_n: 2 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: >- services-platform:modules/tenants/services/provisioning/provision-tenant-failure.ts:applyTenantProvisioningFailure - state_model: STATE-PFM-TNL-001 transition_n: 3 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: >- services-platform:modules/tenants/services/provisioning/submit-tenant-provisioning.ts:retryTenantProvisioning - state_model: STATE-PFM-TNL-001 transition_n: 4 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 5 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading' - state_model: STATE-PFM-TNL-001 transition_n: 6 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 7 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant' - state_model: STATE-PFM-TNL-001 transition_n: 8 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:SUCCESSORS' - state_model: STATE-PFM-TNL-001 transition_n: 9 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:cancelTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 10 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction' - state_model: STATE-PFM-TNL-001 transition_n: 11 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:forceTenantDeletingAfterRestore' - state_model: STATE-PFM-TNL-004 transition_n: 1 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:holdTenantDeletion' - state_model: STATE-PFM-TNL-004 transition_n: 2 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction' - state_model: STATE-PFM-TNL-004 transition_n: 3 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:releaseTenantDeletion' - state_model: STATE-PFM-TNL-004 transition_n: 4 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:cancelTenantDeletion' - state_model: STATE-PFM-TNL-004 transition_n: 5 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:cancelTenantDeletion' - state_model: STATE-PFM-TNL-004 transition_n: 6 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction' - state_model: STATE-PFM-TNL-004 transition_n: 7 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:tenantPurgeOperations' - state_model: STATE-PFM-TNL-004 transition_n: 8 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/tenant-purge-failure.ts:applyTenantPurgeFailure' - state_model: STATE-PFM-TNL-004 transition_n: 9 coverage: 'gap: FND-PFM-TNL-079' provenance: observed source: 'services-platform:modules/tenants/services/deletion/operator-recovery.ts:retryTenantPurge' permission_obligations: - key: platform.tenants.deletion-hold where_checked: api scenario_examples: - ATS-PFM-TNL-014-01 coverage: 'gap: FND-PFM-TNL-079' note: 'Examples do not establish the complete key-by-key grant, revoked-grant and staff-context matrix.' provenance: documented source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md - key: platform.tenants.deletion-cancel where_checked: api scenario_examples: - ATS-PFM-TNL-014-01 coverage: 'gap: FND-PFM-TNL-079' note: 'Examples do not establish the complete key-by-key grant, revoked-grant and staff-context matrix.' provenance: documented source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md - key: platform.tenants.deletion-read where_checked: api scenario_examples: - ATS-PFM-TNL-014-01 coverage: 'gap: FND-PFM-TNL-079' note: 'Examples do not establish the complete key-by-key grant, revoked-grant and staff-context matrix.' provenance: documented source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md evidence_note: >- The test-specific convention lists an Evidence body section, but the corpus checker rejects it. Sources and verification limits remain in frontmatter so this artifact conforms without changing the checker. --- # Pause or cancel deletion while preservation remains possible: Capability Test Specification ## Coverage The category map separates defined scenarios from missing proof. A covered category has a scenario; a binding records inspected test assertions and carries no execution result. State-model completeness and untested interactions remain explicit gaps. | Rule | Proved by | |---|---| | `BR-CAP-PFM-TNL-014-01` | `ATS-PFM-TNL-014-01` | | `BR-CAP-PFM-TNL-014-02` | `ATS-PFM-TNL-014-02` | | `BR-CAP-PFM-TNL-014-03` | `ATS-PFM-TNL-014-03` | | `BR-CAP-PFM-TNL-014-04` | `ATS-PFM-TNL-014-04` | | `BR-CAP-PFM-TNL-014-05` | `ATS-PFM-TNL-014-05`, `ATS-PFM-TNL-014-07` | | `BR-CAP-PFM-TNL-014-06` | `ATS-PFM-TNL-014-06` | | `BR-CAP-PFM-TNL-014-07` | No scenario: `FND-PFM-TNL-079` | ## Interactions With Related Capabilities Cancellation does not imply delivery of its notice. The combined scenario sets up the stated boundary, changes the upstream condition and observes its effect on the dependent outcome. Its steps and assertions are proposed; component tests do not establish this combined execution. | Related capability | Combined coverage | |---|---| | `CAP-PFM-TNL-015` | `ATS-PFM-TNL-014-07` (proposed) | | `CAP-PFM-TNL-016` | `ATS-PFM-TNL-014-07` (proposed) |