Deletion Request

What It Models

A deletion request records a staff decision, its reversible wait, irreversible execution and retained outcome. Its notices and jobs remain inspectable independently of the removed workspace.

Identity and Attributes

The request has an independent generated identity and copied workspace facts, allowing history to outlive the workspace. Copied workspace identity, name and customer, retained without a workspace foreign key. Scheduled, held, cancelled, executing, failed or completed decision standing. A staff explanation from ten to two thousand characters. Requester identity and request instant; no separate approver is required. The selected policy path and day count; disposable waits use minutes with zero whole days. Fixed eligibility at submission; release can extend it but settings do not recompute it. Latest action actor, time and explanation for each preservation action. Execution start and outcome times with a safe failure explanation. Current watcher and purge identities checked by tasks before acting. A false-by-default request to remove the customer when no other workspace remains. Accumulated resource counts; lost batch results can understate them. Reported removable participant inventories, excluding the workspace row and unimplemented resources. Timed staff notice obligations with recorded outcomes, attempts, safe errors and provider facts. Persisted nonzero verification-round count; the configured third failure refuses. External completion evidence for the workspace, decision, counts and backup horizon.

Relationships

The request retains workspace identity and drives its removal standing. The purge uses participant removal and reported inventory. The request retains customer identity and optional final-customer removal intent.

Invariants

The structured invariants distinguish service and database enforcement from documented obligations. The listed enforcement points bound what the workflow can rely on.

How It Is Stored and Shared

Platform’s lifecycle service owns this design object. The physical declarations identify its stored records, while shared jobs provide durable execution and inspection.

Open Design Questions

Cancellation notices can remain unsent, and finalization can stall after workspace removal or after completion without a ledger. Restore protection and those recovery windows need decisions before implementation preparation.