Membership status

The Lifecycle

The diagram summarizes the observed transition rows; declared edges without an observed writer remain outside the operational graph.

Transitions Explained

Membership status controls fresh authorization; provider state and cached decisions can lag. The structured transitions distinguish suspension’s single provider attempt from the durable removal work used for revocation and deletion.

A provider failure does not roll back the committed membership change. The removal queue retries individual messages and can exhaust into its dead-letter queue. Reinstatement does not restore withdrawn invitations.

What Cannot Happen

A suspended membership returns through reinstatement, not invitation resend.

A revoked membership requires invitation and acceptance before becoming active again.

An active membership uses password recovery rather than another invitation.

Concurrency and Timing

Membership capabilities transact their related database changes. Destructive changes apply the relevant customer and staff lockout guards. Repeated revocation retains the original revocation time; acceptance consumes the token conditionally. Deletion removes the membership rather than introducing another status, retaining a former-user record and queuing provider deletion. Queue dispatch runs every minute, but retries, backlog and dead-letter handling preclude a completion deadline.