---
id: WF-PFM-TNL-012
title: Cross the point of no return
trigger: Recheck the locked deletion decision and atomically commit the purge handoff.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Begin destruction (approved 2026-10-09)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-TNL-016
- CAP-PFM-TNL-017
moves:
- STATE-PFM-TNL-001
- STATE-PFM-TNL-004
crosses:
- SVC-PFM-TNL-tenants
- SVC-PFM-SEC-security
idempotency: The first purge submission identity derives from the request. A committed executing request makes an
  ordinary repeat conclude without another handoff.
concurrency: The transaction locks the request and then workspace. Preservation actions arbitrate through the same
  request lock.
hops:
- n: 1
  actor_or_service: Point of no return
  action: Lock the request and require current watcher ownership, scheduled standing and eligibility.
  anchor: services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction
  seam: sync
  on_failure: Return waiting or ended without destruction.
  left_inconsistent: The request remains reversible when checks do not pass.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/begin-destruction.ts
- n: 2
  actor_or_service: Point of no return
  action: Require the request notice and latest final reminder to be delivered or suppressed.
  anchor: services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction
  seam: sync
  on_failure: Return a waiting result for outstanding obligations.
  left_inconsistent: No purge is submitted.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/db/tenant-deletion-notices.table.ts:GATING_TENANT_DELETION_NOTICE_KINDS
- n: 3
  actor_or_service: Point of no return
  action: Lock the workspace and revalidate disabled pending-deletion standing and deletion conditions.
  anchor: services-platform:modules/tenants/services/deletion/request-deletion.ts:assertDeletable
  seam: sync
  on_failure: End for a missing workspace or wait for conditions that can clear.
  left_inconsistent: The reversible request remains unchanged.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/begin-destruction.ts
- n: 4
  actor_or_service: Point of no return
  action: Evaluate the requester’s current grant; hold the request when deletion authority is lost.
  anchor: services-platform:modules/tenants/services/deletion/begin-destruction.ts (resolveGrantSlice, evaluate)
  seam: sync
  on_failure: Record a hold and its notice for staff review.
  left_inconsistent: Removal waits for a new authorized decision.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/begin-destruction.ts
- n: 5
  actor_or_service: Point of no return
  action: Commit executing request, deleting workspace, notice obligation and purge job together.
  anchor: services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction
  seam: sync
  on_failure: Roll back the transaction on error and use task retry handling.
  left_inconsistent: No partial irreversible handoff is committed.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/begin-destruction.ts
- n: 6
  actor_or_service: Watcher
  action: Start purge execution after the handoff and conclude the watcher.
  anchor: services-platform:modules/tenants/services/deletion/tenant-deletion-schedule-operations.ts
  seam: state_machine
  on_failure: Shared recovery can settle an unstarted purge failed.
  left_inconsistent: Staff can need to retry removal from an executing-to-failed request.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/tenant-deletion-schedule-operations.ts
branches:
- Temporary conditions return waiting, including outstanding notices or workspace standing.
- Terminal or superseded decisions conclude the watcher without a new purge.
waits:
- Conditions that can clear are revisited after six hours.
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{begin-destruction, request-deletion, tenant-deletion-schedule-operations}.ts.'
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Cross The Point Of No Return

## What It Does

Recheck the locked deletion decision and atomically commit the purge handoff. The first purge submission identity derives from the request. A committed executing request makes an ordinary repeat conclude without another handoff.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  participant W as Watcher
  participant PNR as Point of no return
  participant DB as Platform database
  participant Sec as Security grants
  participant Purge as Purge job
  W->>PNR: begin destruction
  PNR->>DB: lock request: scheduled, owned, eligible?
  PNR->>DB: gating notices sent?
  PNR->>DB: lock workspace: still deletable?
  PNR->>Sec: requester still authorized?
  alt all hold
    PNR->>DB: request executing, workspace deleting, notice, purge job (one commit)
    W->>Purge: start after commit
  else can still clear
    PNR-->>W: wait six hours
  else cannot clear
    PNR-->>W: end quietly
  end
```

## When Something Fails

Return waiting or ended without destruction. The request remains reversible when checks do not pass. Return a waiting result for outstanding obligations. No purge is submitted. End for a missing workspace or wait for conditions that can clear. The reversible request remains unchanged. Record a hold and its notice for staff review. Removal waits for a new authorized decision. Roll back the transaction on error and use task retry handling. No partial irreversible handoff is committed. Shared recovery can settle an unstarted purge failed. Staff can need to retry removal from an executing-to-failed request.

## Open Design Questions

Readiness of external notices and authority is checked before commit; provider delivery and grant changes remain separate systems.