---
id: TST-PFM-TNL-061
title: Platform irreversible deletion safeguards
kind: integration
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
implements:
  - ATS-PFM-TNL-016-02
  - ATS-PFM-TNL-016-03
  - ATS-PFM-TNL-016-05
  - ATS-PFM-TNL-016-06
  - ATS-PFM-TNL-016-08
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: >-
  Run-owned target and comparison workspace records in the prepared test database; owner access is limited to
  fixture arrangement, independent inspection and cleanup of those records.
evidence:
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/deletion/begin-destruction
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/deletion/deletion-holds
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/deletion/request-deletion
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/persistence/tenant-deletion-requests
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/persistence/tenants
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../db/tenants.table
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../../../services/lifecycle/lifecycle-refusals
  - >-
    services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js
    imports ../../support
binding_scope: >-
  Each implements link names a scenario whose retained cited checks all occur in this file. Partial assertions
  for other scenarios remain evidence only.
partial_scenario_evidence:
  - scenario: ATS-PFM-TNL-014-06
    references:
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses
        a cancel that arrives after the point of no return
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
  - scenario: ATS-PFM-TNL-015-02
    references:
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#owes
        an executing notice, so somebody is told the point of no return was passed
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
  - scenario: ATS-PFM-TNL-015-05
    references:
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits
        while a notice destruction waits for has not been sent
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names
        the notices it is waiting for
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
  - scenario: ATS-PFM-TNL-016-04
    references:
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends
        when the request was cancelled while the job slept
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends
        when another execution now owns the request, which is what a resume looks like
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#touches
        nothing when it ends: the tenant is still awaiting deletion
      - >-
        services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#ends
        when the tenant is already gone
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
---
# Platform irreversible deletion safeguards

## Verification Boundary

The suite invokes production lifecycle services or persistence against its test database. Each fixture and directly called participant belongs to the repository named in the register; this is a local integration boundary.

## What This Suite Proves

Irreversible deletion safeguards is the inspected subject. The implements links identify scenarios whose cited checks occur in this file. The original test-title references delimit those checks; partial contributions to other combined scenarios remain evidence only.

## What It Does Not Prove

Source inspection supplies no passing run. The suite does not establish console behavior, deployment configuration, complete removal in every application or recovery from a provider failure beyond its declared seams. A local zero inventory covers declared and seeded resources only.

## Real Dependencies and Test Doubles

The suite retains its database and production functions as shown by the cited source. Fixture clocks, contexts, seeded Platform facts or callback dependencies remain test inputs. The imported support is recorded as evidence; no external provider result is inferred from a local fixture.

## Must Not Be Doubled

Keep the production service or persistence function and the database constraints, row policies and guarded removal functions under test real. For dispatcher cases, keep route selection and authorization real as well. Provider and remote-application seams must remain explicit and cannot stand in for deployed cross-application qualification.