--- id: JNY-PFM-TNL-004 title: Staff complete a departed customer’s deletion feature: FEAT-PFM-TNL-06 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 actor: ACT-PFM-004 goal: >- The request progresses from reversible waiting to verified removal and retained history. capabilities: - CAP-PFM-TNL-006 - CAP-PFM-TNL-013 - CAP-PFM-TNL-015 - CAP-PFM-TNL-014 - CAP-PFM-TNL-016 - CAP-PFM-TNL-005 - CAP-PFM-TNL-017 - CAP-PFM-TNL-018 screens: [] steps: - 'n': 1 surface: patchHqTenant action: Disable the departing customer’s workspace. capability: CAP-PFM-TNL-006 expected: Ordinary customer access closes. provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#lets Rhythm staff change the same status - 'n': 2 surface: requestTenantDeletion action: Confirm its exact name and record the deletion reason. capability: CAP-PFM-TNL-013 expected: The standard request fixes a waiting date and pending-deletion lifecycle. provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#answers a scheduled request against the tenant asked about - 'n': 3 surface: 'tenant_deletion_schedule: notices' action: Send the initial internal deletion notice. capability: CAP-PFM-TNL-015 expected: The request notice reaches the staff list and requester. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#sends the requested notice on the day of the request - 'n': 4 surface: 'holdTenantDeletionRequest, releaseTenantDeletionRequest' action: Hold for export questions and release after resolution. capability: CAP-PFM-TNL-014 expected: >- The recorded pause and release preserve review time and reminder obligations. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes the date out three days when the original is nearly here - 'n': 5 surface: 'tenant_deletion_schedule: notices' action: Deliver the scheduled waiting-period reminders. capability: CAP-PFM-TNL-015 expected: The reminders occur at their due instants. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#sends both reminders, each on its own day, as the waiting period passes - 'n': 6 surface: 'tenant_deletion_schedule: begin-destruction' action: Recheck current guards at eligibility. capability: CAP-PFM-TNL-016 expected: >- Executing state, deleting lifecycle and the purge job are recorded together. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#begins destruction at the end of the period, and the request records it - 'n': 7 surface: getHqTenant action: Read the workspace details through HQ during removal. capability: CAP-PFM-TNL-005 expected: The workspace details remain available to authorized staff. provenance: observed source: >- services-platform:modules/tenants/aws/api/tenants.routes.ts:getTenantForStaff - 'n': 8 surface: tenant_purge action: Drive planned participant batches and inventories. capability: CAP-PFM-TNL-017 expected: The tested purge completes its declared removal and verification. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs the purge to the end and succeeds - 'n': 9 surface: getTenantDeletionRequest action: Inspect the retained completed deletion decision. capability: CAP-PFM-TNL-018 expected: 'Removal totals, verification and completed ledger work remain recorded.' provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#records on the request what was removed, and the counts it verified alternates: - from_step: 4 condition: The customer returns before execution. path: Cancel the scheduled removal. outcome: The workspace becomes active but needs separate staff re-enablement. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access failures: - from_step: 5 condition: A required reminder fails delivery. path: Keep the schedule waiting for its gating notice. outcome: Destruction does not start with failed required delivery. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#holds the deletion indefinitely when a notice could not be delivered, rather than destroying the tenant unannounced - from_step: 8 condition: A participant cannot remove its resource. path: 'Record the blocked failure, correct its cause and request retry.' outcome: The replacement purge finishes the fixture’s remaining work. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried - from_step: 6 condition: The requester loses staff deletion authority. path: Hold the request with an authority explanation. outcome: A person must review before destruction proceeds. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever rules_in_play: - BR-CAP-PFM-TNL-006-05 - BR-CAP-PFM-TNL-013-03 - BR-CAP-PFM-TNL-013-04 - BR-CAP-PFM-TNL-013-07 - BR-CAP-PFM-TNL-015-05 - BR-CAP-PFM-TNL-014-03 - BR-CAP-PFM-TNL-014-04 - BR-CAP-PFM-TNL-014-06 - BR-CAP-PFM-TNL-016-02 - BR-CAP-PFM-TNL-016-06 - BR-CAP-PFM-TNL-017-03 - BR-CAP-PFM-TNL-017-09 - BR-CAP-PFM-TNL-017-10 - BR-CAP-PFM-TNL-018-04 assertions: - id: AS-JNY-PFM-TNL-004-01 statement: >- The tested declared Platform and CRM tables retain no removed-workspace rows after purge. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves no row of the tenant in any table a participant declares - id: AS-JNY-PFM-TNL-004-02 statement: The sibling workspace fixture remains unchanged. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves the other tenant of the same customer exactly as it was - id: AS-JNY-PFM-TNL-004-03 statement: >- Cancellation that wins before destruction preserves the records; a later cancellation refuses. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#lets exactly one of the two win, every round - id: AS-JNY-PFM-TNL-004-04 statement: >- The completed fixture retains numeric evidence and refuses reuse of the retired identifier. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to create a tenant again under the id of one that was deleted e2e_policy: required e2e_reason: >- The outcome crosses lifecycle operations and warrants end-to-end verification; the current bindings establish backend fixtures, while screen and deployed-service coverage remain separate gaps. --- # Staff complete a departed customer’s deletion ## Story The association departs and staff close its workspace to customer use. A confirmed deletion request starts the review period. Support pauses it to resolve export questions and later releases it. After notices and the current safeguards permit execution, the purge removes its planned resources. The completed decision retains evidence; declaration and CMS gaps remain findings that limit wider removal guarantees.