--- id: CAP-PFM-TNL-017 title: Remove declared workspace resources and verify the result feature: FEAT-PFM-TNL-06 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5, D6' purpose: >- The purge removes planned participant resources and requires zero inventory before completing deletion. outcomes: - Cache-flush work is requested before participant removal. - >- Participants remove data in reverse dependency order through guarded batches. - Inventory and neighboring-workspace checks support the completion decision. - Failure retains deleting lifecycle until staff recovery. concepts: - CON-PFM-TNL-005 - CON-PFM-TNL-003 actors: - ACT-PFM-012 - ACT-PFM-004 surfaces: - job - api preconditions: [] postconditions: [] permissions: - key: platform.tenants.deletion-request where_checked: api scope: global rules: - id: BR-CAP-PFM-TNL-017-01 proved_by: [ATS-PFM-TNL-017-01, TST-PFM-TNL-067] statement: >- Before removal, purge submits a cached-authority flush job and clears local availability facts without awaiting flush completion. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#cuts off cached access before it removes anything origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 At destruction start (approved) - id: BR-CAP-PFM-TNL-017-02 proved_by: [ATS-PFM-TNL-017-02] statement: >- Purge invokes participants in reverse build order, repeating one batch per call until done and removing the workspace record last. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs one step per participant, in the planned order, and completes every one of them origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2 (approved)' - id: BR-CAP-PFM-TNL-017-03 proved_by: [ATS-PFM-TNL-017-03] statement: >- Platform checks purge ownership and deleting lifecycle before each batch; CRM rejects non-deleting participant purges, while protected functions admit the defined loading-reset path. kind: validation enforced_at: - service - database must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#refuses a tenant that is not being deleted origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7, §5.9, §6.6 (approved) - id: BR-CAP-PFM-TNL-017-04 proved_by: [ATS-PFM-TNL-017-04] statement: >- CRM’s protected histories are deleted through guarded functions while ordinary application delete protections remain in place. kind: policy enforced_at: - database must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#empties the record history after the contacts, through the definer function origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6 (approved)' - id: BR-CAP-PFM-TNL-017-05 proved_by: [ATS-PFM-TNL-017-05, TST-PFM-TNL-027] statement: CRM purge disables change-event capture for its removal work. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#records no change event at any point while it purges origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Late events (approved) - id: BR-CAP-PFM-TNL-017-06 proved_by: [ATS-PFM-TNL-017-06, TST-PFM-TNL-067] statement: >- File purge deletes workspace-specific objects and versions using delimited prefixes, preserving similarly named neighboring folders. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves a folder whose name merely begins like the tenant’s, which is what the trailing slash is for origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 platform.assets (approved) - id: BR-CAP-PFM-TNL-017-07 proved_by: [] statement: >- Purge removes the workspace’s portal sign-in resources, sender identities and workspace security data after destruction is authorized. kind: policy enforced_at: - service must_prove: true provenance: documented source: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 security.portal-pool, communications.sender-identity origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5 (Andrew, 2026-10-09); §13 D6 - id: BR-CAP-PFM-TNL-017-08 proved_by: [ATS-PFM-TNL-017-07, TST-PFM-TNL-066] statement: >- A participant unable to remove or account for its resources blocks completion with an explanation and leaves the workspace deleting. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#fails the request with the participant’s own reason when a participant is blocked origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 not_applicable vs blocked (approved) - id: BR-CAP-PFM-TNL-017-09 proved_by: [ATS-PFM-TNL-017-08] statement: >- Inventory checks all planned participants apart from the workspace row; non-zero results repeat removal and the third non-zero verification refuses completion. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to finish, with the counts, when something keeps writing to the tenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Final sweep (approved) - id: BR-CAP-PFM-TNL-017-10 proved_by: [ATS-PFM-TNL-017-09, ATS-PFM-TNL-017-14, ATS-PFM-TNL-017-15, TST-PFM-TNL-003, TST-PFM-TNL-114] statement: >- Purge fixtures in Platform, CRM, Committees and Marketing preserve neighboring workspace records. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves the other tenant of the same customer exactly as it was origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§10 Acceptance criterion 5 (approved) - id: BR-CAP-PFM-TNL-017-11 proved_by: [ATS-PFM-TNL-017-10] statement: >- Finalization removes the workspace and lifecycle register entries, conditionally removes its final customer and preserves product catalog and deletion-job evidence. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#deletes the customer with its last tenant when the request asked for it origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 shared (approved) - id: BR-CAP-PFM-TNL-017-12 proved_by: [ATS-PFM-TNL-017-11] statement: >- Authorized staff retry only failed purges, carrying completed work; late reports from the replaced attempt cannot change the current request. kind: lifecycle enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Retry a failed purge (approved) - id: BR-CAP-PFM-TNL-017-13 proved_by: [] statement: >- Platform records removal totals after a participant returns its committed batch, across a separate transaction boundary. kind: policy enforced_at: - service must_prove: true provenance: observed source: >- services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:purgeParticipantOperation origin: none - id: BR-CAP-PFM-TNL-017-14 proved_by: [] statement: >- Committees removes parent, meeting and decision references before deleting the records those references target. kind: policy enforced_at: - service must_prove: true provenance: observed source: >- services-committees:modules/tenant-lifecycle/services/persistence/tenant-purges.ts:unlinkDecisionReferences origin: none scenarios: - id: SC-CAP-PFM-TNL-017-01 given: A service interruption stops participant removal. when: An administrator retries the failed purge after recovery. then: >- The retry completes outstanding participant work and the request retains its removal totals. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-016 - CAP-PFM-TNL-007 related: - CAP-PFM-TNL-018 - CAP-PFM-TNL-015 - CAP-PFM-TNL-012 journeys: - JNY-PFM-TNL-004 open_questions: [] evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5, D6 - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#cuts off cached access before it removes anything - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 At destruction start (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs one step per participant, in the planned order, and completes every one of them - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2 (approved) - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#refuses a tenant that is not being deleted - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7, §5.9, §6.6 (approved) - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#empties the record history after the contacts, through the definer function - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6 (approved) - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#records no change event at any point while it purges - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Late events (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves a folder whose name merely begins like the tenant’s, which is what the trailing slash is for - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 platform.assets (approved) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 security.portal-pool, communications.sender-identity - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5 (Andrew, 2026-10-09); §13 D6 - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#fails the request with the participant’s own reason when a participant is blocked - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 not_applicable vs blocked (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to finish, with the counts, when something keeps writing to the tenant - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Final sweep (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves the other tenant of the same customer exactly as it was - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§10 Acceptance criterion 5 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#deletes the customer with its last tenant when the request asked for it - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 shared (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Retry a failed purge (approved) - >- Inspected source: services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:purgeParticipantOperation - >- Inspected source: services-committees:modules/tenant-lifecycle/services/persistence/tenant-purges.ts:unlinkDecisionReferences controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-06-01, FAS-PFM-TNL-06-02, FAS-PFM-TNL-06-03, FAS-PFM-TNL-06-04, FAS-PFM-TNL-06-05] suites: [TST-PFM-TNL-003, TST-PFM-TNL-027, TST-PFM-TNL-066, TST-PFM-TNL-067, TST-PFM-TNL-114] --- # Remove declared workspace resources and verify the result ## Purpose The purge removes planned participant resources and requires zero inventory before completing deletion. ## How It Works The purge begins by requesting cached-authority invalidation. It then asks each planned participant to remove a batch in reverse construction order. Every Platform batch checks the request’s current purge ownership and workspace state. A participant that needs more work is called again. A blocked result fails with the participant’s explanation. Removal totals are recorded after the participant returns and therefore have a separate failure boundary. Verification inventories planned resources and repeats removal when counts remain. The workspace row is removed at finalization, with conditional customer removal and retained deletion evidence. Failed purges can be retried by authorized staff. Missing remote declarations and Websites’ unpurged CMS resources limit what this verification establishes. ## Relationships - Revalidate the irreversible deletion decision: Its result establishes the state or declared resources needed by this operation. - Account for each application’s lifecycle responsibilities: Its result establishes the state or declared resources needed by this operation. - Retain deletion evidence and prevent identifier reuse: Retired identifiers and retained removal history also constrain this work. - Keep deletion decisions visible to staff: The capabilities share the workspace’s recorded lifecycle decision. - Recover an incorrect initial import: Its reset classification distinguishes imported records from retained setup.