01must proveProposed | Deletion requests and their hold, release, cancellation, read and recovery actions each require staff permission; customer administrators cannot perform them, and no immediate-delete action is available. no proof recorded yet | permission | api | test |
02must proveProposed | Requesting deletion requires disabled status, active or failed-provisioning lifecycle, no lock or sandboxes, a workspace outside the protected development set, exact name confirmation, a 10–2,000-character reason and the version read. no proof recorded yet | validation | api, service | test |
03must proveProposed | Only one open deletion request may exist per workspace; cancellation permits a later request with a new identity and waiting period. no proof recorded yet | invariant | service, database | test |
04must proveProposed | The request fixes its eligibility date using the workspace calendar: normally thirty days, one day if never activated, and minutes only for disposable non-production workspaces; production configuration below fourteen days is refused. no proof recorded yet | calculation | service | test |
05must proveProposed | Staff notices accompany request creation, reminders, holds, releases, cancellation, destruction and outcomes; destruction requires delivery of the request notice and one-day reminder and keeps waiting when delivery fails. no proof recorded yet | policy | service | test |
06must proveProposed | A reasoned hold blocks progress without changing the eligibility date; release within three days of eligibility or after it gives a further three days and schedules another one-day reminder. no proof recorded yet | calculation | service | test |
07must proveProposed | Cancellation before destruction restores active lifecycle but preserves disabled status; cancellation after destruction starts fails. no proof recorded yet | lifecycle | service | test |
08must proveProposed | Destruction rechecks eligibility, gating notices, request state, disabled status, absence of locks and sandboxes and the requester’s current authority; lost requester authority puts the request on hold. no proof recorded yet | policy | service | test |
09must proveProposed | Concurrent cancellation and destruction serialize so that one outcome wins without leaving partially updated lifecycle state. no proof recorded yet | invariant | service, database | test |
10must proveProposed | Recovery can restart a stopped schedule without advancing eligibility and can restart purge only after purge failure. no proof recorded yet | policy | service | test |
11must proveProposed | The deletion request retains workspace and customer identity, actors, reasons and removal counts after workspace removal, and the retired workspace identifier remains unavailable for reuse. no proof recorded yet | invariant | service, database | test |
12Proposed | Staff can page through requests by state or workspace, inspect notices and progress, and receive no more than 100 requests per page. | policy | api, service | test |
13must proveProposed | The product should add a reasoned security-audit event for deletion recovery; the inspected recovery path does not currently write that event. no proof recorded yet | policy | service | unknown |