---
id: WF-PFM-TNL-010
title: Hold, release or cancel a deletion
trigger: Pause, release or cancel a deletion before it becomes irreversible.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2, §5.4, §8.2 (approved 2026-10-09)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-TNL-014
- CAP-PFM-TNL-015
moves:
- STATE-PFM-TNL-001
- STATE-PFM-TNL-004
- STATE-PFM-TNL-005
crosses:
- SVC-PFM-TNL-tenants
idempotency: A repeated command with the previous reviewed version is refused instead of applying twice.
concurrency: Preservation actions and irreversible handoff contend on the request row. The winner’s standing and
  version govern later refusals.
hops:
- n: 1
  actor_or_service: Platform API (hold, release, cancel)
  action: Check the action’s staff permission, reason and reviewed version.
  anchor: services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts
  seam: sync
  on_failure: Refuse invalid or unauthorized input.
  left_inconsistent: The decision is unchanged.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts
- n: 2
  actor_or_service: Deletion actions
  action: Lock the request and inspect irreversible standing before the reviewed version.
  anchor: services-platform:modules/tenants/services/deletion/deletion-holds.ts
  seam: sync
  on_failure: Return execution, version or action-state refusal.
  left_inconsistent: The competing decision retains its committed result.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/deletion-holds.ts
- n: 3
  actor_or_service: Deletion actions
  action: Apply hold, release or cancellation, including the release floor or disabled-active cancellation result.
  anchor: services-platform:modules/tenants/services/deletion/deletion-holds.ts:holdTenantDeletion, releaseTenantDeletion,
    cancelTenantDeletion
  seam: sync
  on_failure: Roll back the action transaction on error.
  left_inconsistent: No partial action is committed.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/notice-schedule.ts:noticesForRelease
- n: 4
  actor_or_service: Deletion actions
  action: Store the action’s notice obligations in the same transaction.
  anchor: services-platform:modules/tenants/services/deletion/deletion-holds.ts
  seam: sync
  on_failure: Roll back with the action if notice persistence fails.
  left_inconsistent: Action and obligations are retained together.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/deletion-holds.ts
- n: 5
  actor_or_service: Watcher
  action: On a later watcher pass, inspect current standing and send notices only where the schedule still admits
    the request.
  anchor: services-platform:modules/tenants/services/deletion/tenant-deletion-schedule-operations.ts
  seam: state_machine
  on_failure: Apply notice retry policy for admitted sends.
  left_inconsistent: A cancellation makes the watcher conclude before sending its cancelled notice.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/tenant-deletion-schedule-operations.ts
branches:
- Lost requester authority creates a hold that staff can review and release.
waits:
- Release retains at least three days before eligibility.
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{deletion-holds, notice-schedule, tenant-deletion-schedule-operations}.ts;
  services/persistence/tenant-deletion-requests.ts.'
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Hold, Release Or Cancel A Deletion

## What It Does

Pause, release or cancel a deletion before it becomes irreversible. A repeated command with the previous reviewed version is refused instead of applying twice.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  actor Staff as Rhythm staff
  participant API as Platform staff route
  participant Act as Deletion actions
  participant DB as Platform database
  participant W as Watcher
  Staff->>API: hold, release or cancel (reason, version)
  API->>Act: authorize and validate
  Act->>DB: lock request; executing? stale? wrong state?
  Act->>DB: apply the change and owe its notice (one commit)
  W->>DB: next wake: send the notice, end or keep waiting
```

## When Something Fails

Refuse invalid or unauthorized input. The decision is unchanged. Return execution, version or action-state refusal. The competing decision retains its committed result. Roll back the action transaction on error. No partial action is committed. Roll back with the action if notice persistence fails. Action and obligations are retained together. Apply notice retry policy for admitted sends. A cancellation makes the watcher conclude before sending its cancelled notice.

## Open Design Questions

Role distribution remains Security’s responsibility. The cancelled notice is stored but the watcher exits before sending it, leaving no ordinary delivery pass.