---
id: CON-PFM-TNL-001
name: Workspace Lifecycle
feature: FEAT-PFM-TNL-02
product_area: platform
module: tenant-lifecycle
revision: 2
status: draft
product_intent: confirmed
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf
  services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c
definition: >-
  Workspace lifecycle records readiness and removal state, supplying the facts
  used to decide availability.
owned_by: MOD-PFM-TNL
synonyms:
  - lifecycle state
  - workspace state
not_to_be_confused_with:
  - business mode and workspace purpose
facets:
  - name: Lifecycle state
    meaning: >-
      The state distinguishes building, failed construction, active use,
      loading, pending deletion and destruction. Allowed transitions prevent an
      ordinary workflow from skipping directly into irreversible removal.
    used_for: Interpreting readiness and permitted next steps.
  - name: Business status
    meaning: >-
      Staff control live, implementation and disabled standing. Database checks
      tie loading to implementation and deletion to disabled status.
    used_for: Maintaining the required agreement between lifecycle and business mode.
  - name: First activation
    meaning: >-
      The first opening time persists through later lifecycle changes. Its
      absence selects the shorter deletion wait; it is a recorded event, rather
      than a count of imported records.
    used_for: Selecting the never-activated waiting path.
  - name: Loading history
    meaning: >-
      Operator, time and explanation document when initial import began.
      Activation retains that history for later inspection.
    used_for: Reviewing the accountable import opening.
  - name: Disposable designation
    meaning: >-
      Test workspaces can use accelerated deletion outside Production.
      Production refuses the designation’s creation and accelerated path.
    used_for: Exercising accelerated removal in tests.
  - name: Availability
    meaning: >-
      Applications derive an available, unavailable or read-only answer from
      current facts and caller context. Processes reuse those facts briefly and
      invalidate their own cached entry when changing them.
    used_for: Applying caller-specific availability.
relationships:
  - to: CON-PFM-TNL-002
    statement: >-
      Provisioning changes workspace readiness toward active or failed
      construction.
    provenance: observed
    source: >-
      services-platform:modules/tenants/services/provisioning/provision-tenant-operations.ts:activateOperation
  - to: CON-PFM-TNL-004
    statement: >-
      Initial loading temporarily moves an implementation workspace out of
      active use.
    provenance: observed
    source: >-
      services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
  - to: CON-PFM-TNL-005
    statement: 'Deletion requests control pending removal, cancellation and destruction.'
    provenance: observed
    source: 'services-platform:modules/tenants/services/deletion/request-deletion.ts'
lifecycle:
  - state: provisioning
    meaning: Construction is unfinished and ordinary customer requests are unavailable.
    how_it_changes: Readiness activates it; construction failure requires recovery.
  - state: provisioning failed
    meaning: The unsuccessful build preserves partial resources.
    how_it_changes: Staff request retry or deliberate removal.
  - state: active
    meaning: Customer use is possible unless business status is disabled.
    how_it_changes: >-
      Loading temporarily closes ordinary use; disabled workspaces may enter
      deletion.
  - state: loading
    meaning: 'Initial import is open, with route and staff access exceptions.'
    how_it_changes: Activation authority ends the loading period.
  - state: awaiting deletion
    meaning: The workspace is disabled with a cancellable removal decision.
    how_it_changes: Cancellation returns active lifecycle; execution begins destruction.
  - state: being deleted
    meaning: >-
      Destruction is irreversible and the availability gate limits staff to
      reads.
    how_it_changes: Successful finalization removes the workspace record.
acted_on_by:
  - CAP-PFM-TNL-001
  - CAP-PFM-TNL-002
  - CAP-PFM-TNL-005
  - CAP-PFM-TNL-006
  - CAP-PFM-TNL-011
  - CAP-PFM-TNL-013
  - CAP-PFM-TNL-014
  - CAP-PFM-TNL-016
visible_to:
  - ACT-PFM-004
  - ACT-PFM-039
  - ACT-PFM-040
  - ACT-PFM-041
  - ACT-PFM-042
  - ACT-PFM-012
evidence:
  - >-
    Inspected source:
    services-platform:modules/tenants/services/provisioning/provision-tenant-operations.ts:activateOperation
  - >-
    Inspected source:
    services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
  - >-
    Inspected source:
    services-platform:modules/tenants/services/deletion/request-deletion.ts
supersedes: []
intent_sources:
  - >-
    services-platform:docs/tenants/tenant-lifecycle-plan.md#§2.2 (approved
    2026-10-09)
---

# Workspace Lifecycle

## What It Is

A customer workspace has a continuing identity while its readiness and availability change. Workspace lifecycle describes that progression: construction, opening, initial loading and eventual removal. Staff use it to distinguish a workspace that needs recovery from one ready for customer work. The state belongs to the system and moves through lifecycle workflows rather than through an ordinary record editor.

Lifecycle sits beside business status. An active workspace may be live, in implementation or disabled; the customer’s access depends on both descriptions. Keeping those axes separate lets staff describe commercial or implementation standing without pretending that a build or deletion has finished. The stored first-activation time and loading record explain important events along the progression.

## What It Is Not

Lifecycle does not describe the workspace’s purpose, such as customer, sandbox or training. It also does not replace a person’s roles. Availability answers whether the workspace can serve a request; authorization still determines whether that caller can perform the operation. The absence of a workspace record after deletion is different from a stored final lifecycle state.

## How It Is Used

Rhythm administrators follow construction and decide whether a failed workspace needs retry or disposal. Import operators open a protected loading period, and go-live approvers end it after reviewing the result. Support can inspect closed workspaces through authorized system access. During destruction that access becomes read-only through the availability gate.

Customer-context requests normally require active lifecycle and a non-disabled status. Loading admits the data-job surface that carries the import. Authorized staff system requests retain a separate exception. Background enumeration and baseline reconciliation use purpose-specific eligibility definitions, which staff must understand before treating every closed workspace alike.

## Its Facets

**Lifecycle state.** The state distinguishes building, failed construction, active use, loading, pending deletion and destruction. Allowed transitions prevent an ordinary workflow from skipping directly into irreversible removal.

**Business status.** Staff control live, implementation and disabled standing. Database checks tie loading to implementation and deletion to disabled status.

**First activation.** The first opening time persists through later lifecycle changes. Its absence selects the shorter deletion wait; it is a recorded event, rather than a count of imported records.

**Loading history.** Operator, time and explanation document when initial import began. Activation retains that history for later inspection.

**Disposable designation.** Test workspaces can use accelerated deletion outside Production. Production refuses the designation’s creation and accelerated path.

**Availability.** Applications derive an available, unavailable or read-only answer from current facts and caller context. Processes reuse those facts briefly and invalidate their own cached entry when changing them.

## How It Relates

Provisioning introduces and opens the workspace. Initial loading temporarily changes its availability without changing its identity. Deletion requests control the transition into removal. Application participants consume those facts while building or purging resources. The separate workspace administration module owns ordinary workspace fields, customer relationships and access configuration.

## What It Could Become

The product should close the restore interval in which a deleted workspace can return before ledger recovery runs. It should also settle the distinct meanings of operational eligibility for background work, staff initialization and baseline reconciliation. Those choices affect availability and configuration without requiring additional broad concepts.