--- id: CAP-PFM-TNL-016 title: Revalidate the irreversible deletion decision feature: FEAT-PFM-TNL-06 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Execute' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8' purpose: >- The schedule rechecks current facts before committing destruction and its purge job. outcomes: - The HTTP surface offers no execute-now or force action. - Recoverable obstacles wait and terminal requests end without mutation. - Concurrent cancellation and destruction yield one consistent winner. concepts: - CON-PFM-TNL-005 - CON-PFM-TNL-001 actors: - ACT-PFM-012 - ACT-PFM-004 surfaces: - job - api preconditions: [] postconditions: [] permissions: - key: platform.tenants.deletion-request where_checked: service scope: global rules: - id: BR-CAP-PFM-TNL-016-01 proved_by: [ATS-PFM-TNL-016-01] statement: >- Deletion HTTP routes expose neither immediate execution nor a force option; destruction begins through the schedule’s service call. kind: permission enforced_at: - service must_prove: true provenance: observed source: >- services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Execute: nobody (approved) - id: BR-CAP-PFM-TNL-016-02 proved_by: [ATS-PFM-TNL-016-02, TST-PFM-TNL-061] statement: >- Before destruction, locked request and workspace facts are rechecked for schedule ownership, eligibility, gating notices, pending-deletion and disabled state, locks, children and protected identity. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits one millisecond before the date origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Begin destruction (approved) - id: BR-CAP-PFM-TNL-016-03 proved_by: [ATS-PFM-TNL-016-03, TST-PFM-TNL-061] statement: >- If the requester no longer has active staff deletion authority, the request is held with that reason for human review. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 (approved)' - id: BR-CAP-PFM-TNL-016-04 proved_by: [ATS-PFM-TNL-016-04] statement: >- Temporary obstacles cause another check six hours later; terminal or superseded requests and missing workspaces end the watcher without mutation. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#touches nothing when it ends: the tenant is still awaiting deletion origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4, §5.7 (approved) - id: BR-CAP-PFM-TNL-016-05 proved_by: [ATS-PFM-TNL-016-05, ATS-PFM-TNL-016-09, TST-PFM-TNL-061] statement: >- One transaction marks execution, moves the disabled workspace to deleting, creates the executing notice and records the purge job. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the purge job it submitted in the same transaction, so the point of no return and its destruction commit together origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 (approved)' - id: BR-CAP-PFM-TNL-016-06 proved_by: [ATS-PFM-TNL-016-06, TST-PFM-TNL-061] statement: >- A cancellation racing destruction has one winner: either cancellation preserves the records or destruction starts and cancellation is rejected. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#lets exactly one of the two win, every round origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4; §10 Acceptance criterion 4 (approved) - id: BR-CAP-PFM-TNL-016-07 proved_by: [ATS-PFM-TNL-016-07, TST-PFM-TNL-051] statement: >- Staff may resume a stopped watcher through a new schedule job, preserving eligibility and holds; a live watcher prevents another resume. kind: policy enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the request scheduled, and its eligibility exactly where it was: a resume cannot bring a deletion forward origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Resume a stuck schedule (approved) - id: BR-CAP-PFM-TNL-016-08 proved_by: [] statement: >- The watcher execution permits a year and has no job retry; recovery uses an operator’s resume action. kind: policy enforced_at: - service must_prove: false provenance: documented source: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.4 tenant_deletion_schedule origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.4 (approved)' scenarios: - id: SC-CAP-PFM-TNL-016-01 given: The requester loses deletion authority during the wait. when: The schedule rechecks at eligibility. then: >- The request is held with an authority explanation and destruction does not start. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-013 - CAP-PFM-TNL-015 related: - CAP-PFM-TNL-014 - CAP-PFM-TNL-017 journeys: - JNY-PFM-TNL-004 open_questions: [] evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Execute - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 - >- Inspected source: services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Execute: nobody (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#waits one millisecond before the date - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Begin destruction (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#touches nothing when it ends: the tenant is still awaiting deletion - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4, §5.7 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the purge job it submitted in the same transaction, so the point of no return and its destruction commit together - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#lets exactly one of the two win, every round - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4; §10 Acceptance criterion 4 (approved) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the request scheduled, and its eligibility exactly where it was: a resume cannot bring a deletion forward - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Resume a stuck schedule (approved) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.4 tenant_deletion_schedule - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.4 (approved) controls: [TC-AVL-001, TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-05-02, FAS-PFM-TNL-06-01, FAS-PFM-TNL-06-02, FAS-PFM-TNL-06-03, FAS-PFM-TNL-06-04, FAS-PFM-TNL-06-05] suites: [TST-PFM-TNL-051, TST-PFM-TNL-061] --- # Revalidate the irreversible deletion decision ## Purpose The schedule rechecks current facts before committing destruction and its purge job. ## How It Works The waiting period ends with a fresh decision against locked request and workspace records. The schedule checks ownership, date, gating notices and workspace eligibility. It also rereads the requester’s current staff authority. Lost authority holds the request for human attention. Other temporary obstacles make the watcher check again later. Cancelled, completed or superseded requests end its work quietly. When all guards hold, one transaction records executing state, deleting lifecycle, the notice and purge job. Cancellation competes for the same decision and cannot partly win. A stopped watcher can be resumed by an operator without changing eligibility or releasing a hold. ## Relationships - Schedule deliberate workspace deletion: Its result establishes the state or declared resources needed by this operation. - Keep deletion decisions visible to staff: Its result establishes the state or declared resources needed by this operation. - Pause or cancel deletion while preservation remains possible: The capabilities share the workspace’s recorded lifecycle decision. - Remove declared workspace resources and verify the result: Its batches and inventory determine the removal result.