Workspace retirement request

The Lifecycle

The diagram summarizes the observed transition rows; declared edges without an observed writer remain outside the operational graph.

Transitions Explained

The request is retained independently of the workspace it removes. Its structured transitions identify the cancellable period, destructive boundary, forward-retry state and database completion.

Completion of the request is earlier than guaranteed completion of external ledger work. Task replay can finish that work, but request-specific purge retry accepts failed requests only. Operator recovery for retry exhaustion remains a finding.

What Cannot Happen

Cancellation cannot promise preservation after the destructive boundary, so it is rejected.

Partial destruction cannot return to a pre-destruction waiting state.

A later retirement after cancellation needs a new request and its own eligibility calculation.

Completed requests are not reopened. Task replay may finish external work; a restored workspace follows the ledger-reapplication path.

Concurrency and Timing

Request and workspace locks serialize holds, releases, cancellation and the destructive boundary. Unique indexes admit one open request. Recovery replaces the named schedule or purge job, causing stale tasks to settle or refuse. A completed request can coexist with an unfinished external ledger write; the failure consequence does not turn that completed request into failed.