---
id: WF-PFM-TNL-016
title: Report leftovers and long-disabled workspaces
trigger: Report scoped leftovers and long-disabled workspaces for operational review.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3, §13 D9 (approved 2026-10-09; D9 default in
  force)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-TNL-018
- CAP-PFM-TNL-013
moves: []
crosses:
- SVC-PFM-TNL-tenants
idempotency: Both reports only read; repetition has no mutation effect.
concurrency: Each leftover count runs in the selected workspace context; the reports are not a cross-service snapshot.
hops:
- n: 1
  actor_or_service: Orphan report
  action: Read retained deletion requests and running deletion-job records as report candidates.
  anchor: services-platform:modules/tenants/services/deletion/orphan-report.ts:readTenantOrphanReport
  seam: sync
  on_failure: Return the read error.
  left_inconsistent: The report changes no records.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/orphan-report.ts
- n: 2
  actor_or_service: Orphan report
  action: Count Platform participant leftovers for missing workspaces and compare requests and running jobs with
    retained standing.
  anchor: services-platform:modules/tenants/services/deletion/orphan-report.ts
  seam: sync
  on_failure: A participant read error can fail the report; no per-participant catch is present.
  left_inconsistent: Remote application leftovers and unknown identities remain outside the report.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/orphan-report.ts
- n: 3
  actor_or_service: Long-disabled report
  action: List sufficiently long-disabled workspaces for staff review without scheduling removal.
  anchor: services-platform:modules/tenants/scripts/long-disabled.ts
  seam: sync
  on_failure: Return the read error.
  left_inconsistent: The report leaves every decision to staff.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:listLongDisabledTenants
branches:
- Identities absent from the retained request inventory cannot be discovered by this report.
waits: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/orphan-report.ts; scripts/{orphans, long-disabled,
  script-boundary}.ts; docs/tenants/runbook.md.'
controls: [TC-AVL-001, TC-AVL-002, TC-AVL-003, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-007, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Report Leftovers And Long-Disabled Workspaces

## What It Does

Report scoped leftovers and long-disabled workspaces for operational review. Both reports only read; repetition has no mutation effect.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  actor Op as Operator
  participant Rep as Orphan report
  participant DB as Platform database
  participant PFM as Platform participants
  Op->>Rep: run
  Rep->>DB: deletion requests and job roots
  loop each workspace whose record is gone
    Rep->>PFM: inventory inside that workspace
  end
  Rep-->>Op: leftovers, mismatched requests, orphan jobs
```

## When Something Fails

Return the read error. The report changes no records. A participant read error can fail the report; no per-participant catch is present. Remote application leftovers and unknown identities remain outside the report. Return the read error. The report leaves every decision to staff.

## Open Design Questions

The orphan report reaches Platform participants only and cannot detect every remote or undeclared resource. Long-disabled age uses record modification time rather than a dedicated disable time.