Deletion Request

The Lifecycle

Transitions Explained

A new request waits with fixed eligibility. Staff can hold, release or cancel it while reversible; release extends eligibility and creates another reminder. The watcher rechecks the locked decision and requester authority. Lost authority places it on hold, while passing checks commits execution and its purge job.

Failed removal keeps destruction standing and permits forward retry. Database finalization records completion before notice and ledger work finishes, so completed standing does not prove every external obligation succeeded.

What Cannot Happen

Hold, release and cancellation cannot reverse executing or failed removal. Cancelled and completed decisions are historical records; new removal uses a new request. A held request must be released before the watcher can execute it.

Concurrency and Timing

Conditional request updates and row locks arbitrate preservation against destruction. Watcher and purge tasks check the job references before acting. The schedule sleeps in the state machine, rechecking conditions at recorded notice times and after retry waits; its execution is bounded to one year.