--- id: CAP-PFM-TNL-018 title: Retain deletion evidence and prevent identifier reuse feature: FEAT-PFM-TNL-06 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: partially-observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§9' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7' purpose: >- Deletion keeps a minimal history and an external ledger for identifier retirement and restore recovery. outcomes: - >- The request retains lifecycle identity and action history after workspace removal. - Completed deletion permanently retires the identifier. - Restore reapplication removes ledger-listed workspaces that reappear. concepts: - CON-PFM-TNL-005 actors: - ACT-PFM-004 - ACT-PFM-012 surfaces: - api - job preconditions: [] postconditions: [] permissions: - key: platform.tenants.deletion-read where_checked: api scope: global - key: hq.tenants.update where_checked: api scope: global rules: - id: BR-CAP-PFM-TNL-018-01 proved_by: [ATS-PFM-TNL-018-01, TST-PFM-TNL-067] statement: >- Completed requests store numeric removal totals and the inventory showing no remaining participant data. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#records on the request what was removed, and the counts it verified origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved)' - id: BR-CAP-PFM-TNL-018-02 proved_by: [ATS-PFM-TNL-018-02] statement: >- Requests and notices retain workspace and customer identity, actors, explanations and dates independently of the deleted workspace record. kind: invariant enforced_at: - database must_prove: true provenance: observed source: 'services-platform:modules/tenants/db/tenant-deletion-requests.table.ts' origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved)' - id: BR-CAP-PFM-TNL-018-03 proved_by: [ATS-PFM-TNL-018-03] statement: >- Completion also writes a workspace-keyed ledger outside the database with live-removal and backup-expiry times. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#writes the permanent deletion record outside the database, keyed by the tenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Restoring without resurrecting (approved) - id: BR-CAP-PFM-TNL-018-04 proved_by: [ATS-PFM-TNL-018-04, TST-PFM-TNL-066] statement: >- A completed deletion retires the workspace identifier and creation refuses reuse with the retiring deletion identified. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to create a tenant again under the id of one that was deleted origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved); services-platform:docs/tenants/tenant-identity.md - id: BR-CAP-PFM-TNL-018-05 proved_by: [] statement: >- Live removal leaves backups to expire within the documented thirty-five-day Production retention period. kind: policy enforced_at: - service must_prove: false provenance: documented source: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Live deletion is not backup erasure origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7 (default in force) - id: BR-CAP-PFM-TNL-018-06 proved_by: [] statement: >- Restore reapplication disables ledger-listed workspaces that reappear and purges them without another wait or notices; its default mode only reports proposed actions. kind: lifecycle enforced_at: - service must_prove: true provenance: observed source: 'services-platform:modules/tenants/services/deletion/reapply-deletions.ts' origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 (approved)' - id: BR-CAP-PFM-TNL-018-07 proved_by: [ATS-PFM-TNL-018-07] statement: >- The product should keep ledger-listed restored workspaces unavailable until deletion is reapplied. kind: policy enforced_at: - api must_prove: true provenance: unknown source: FND-PFM-TNL-004 origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 (approved)' - id: BR-CAP-PFM-TNL-018-08 proved_by: [ATS-PFM-TNL-018-05, TST-PFM-TNL-057] statement: >- Immediate deletion refuses without reading or altering the workspace and directs callers to the deletion-request process. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the tenant exactly as it was, which is the point of refusing origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved)' - id: BR-CAP-PFM-TNL-018-09 proved_by: [] statement: >- The orphan report reads Platform participant leftovers, missing workspaces behind open requests, returned workspaces behind completed deletions and jobs without a request to follow. kind: policy enforced_at: - service must_prove: false provenance: observed source: >- services-platform:modules/tenants/services/deletion/orphan-report.ts (header) origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3 (approved)' scenarios: - id: SC-CAP-PFM-TNL-018-01 given: A restore returns a previously deleted workspace. when: Staff apply the deletion-ledger recovery process. then: >- The workspace is disabled and purged again with the prior deletion referenced. provenance: observed source: 'services-platform:modules/tenants/services/deletion/reapply-deletions.ts' - id: SC-CAP-PFM-TNL-018-02 given: A returning customer asks for its retired identifier. when: Staff submit another workspace request using it. then: Creation refuses retirement and requires a different identifier. provenance: documented source: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10' edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-017 related: - CAP-PFM-TNL-001 - CAP-PFM-TNL-005 journeys: - JNY-PFM-TNL-004 open_questions: [] evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 - 'Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9' - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7 - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#records on the request what was removed, and the counts it verified - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved) - >- Inspected source: services-platform:modules/tenants/db/tenant-deletion-requests.table.ts - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#writes the permanent deletion record outside the database, keyed by the tenant - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Restoring without resurrecting (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to create a tenant again under the id of one that was deleted - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved); services-platform:docs/tenants/tenant-identity.md - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Live deletion is not backup erasure - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7 (default in force) - >- Inspected source: services-platform:modules/tenants/services/deletion/reapply-deletions.ts - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 (approved) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the tenant exactly as it was, which is the point of refusing - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved) - >- Inspected source: services-platform:modules/tenants/services/deletion/orphan-report.ts (header) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3 (approved) controls: [TC-AVL-001, TC-AVL-002, TC-AVL-003, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-003, TC-DAT-004, TC-DAT-007, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-06-01, FAS-PFM-TNL-06-02, FAS-PFM-TNL-06-03, FAS-PFM-TNL-06-04, FAS-PFM-TNL-06-05] suites: [TST-PFM-TNL-057, TST-PFM-TNL-066, TST-PFM-TNL-067] --- # Retain deletion evidence and prevent identifier reuse ## Purpose Deletion keeps a minimal history and an external ledger for identifier retirement and restore recovery. ## How It Works Completion leaves the request and notices readable independently of the workspace. They explain the actors, reasons, dates and numeric removal evidence. An external ledger records the completed deletion and backup-expiry estimate. Creation checks that ledger before accepting an identifier again. Live deletion leaves backups to age out under the documented retention period. Following a restore, staff can inspect ledger-listed workspaces and explicitly apply removal again. That recovery bypasses a new waiting period. The access gate still lacks the planned ledger check during the interval before recovery. The orphan report supplies a narrower view of Platform leftovers and missing request relationships. Immediate delete remains a refusal directing staff into the request process. ## Relationships - Remove declared workspace resources and verify the result: Its result establishes the state or declared resources needed by this operation. - Request a complete customer workspace: The capabilities share the workspace’s recorded lifecycle decision. - Apply workspace availability consistently: Its access decision determines when callers can use the workspace.