Retain deletion evidence and prevent identifier reuse

Purpose

Deletion keeps a minimal history and an external ledger for identifier retirement and restore recovery.

How It Works

Completion leaves the request and notices readable independently of the workspace. They explain the actors, reasons, dates and numeric removal evidence. An external ledger records the completed deletion and backup-expiry estimate. Creation checks that ledger before accepting an identifier again. Live deletion leaves backups to age out under the documented retention period. Following a restore, staff can inspect ledger-listed workspaces and explicitly apply removal again. That recovery bypasses a new waiting period. The access gate still lacks the planned ledger check during the interval before recovery. The orphan report supplies a narrower view of Platform leftovers and missing request relationships. Immediate delete remains a refusal directing staff into the request process.

Relationships

Remove declared workspace resources and verify the result: Its result establishes the state or declared resources needed by this operation.
Request a complete customer workspace: The capabilities share the workspace’s recorded lifecycle decision.
Apply workspace availability consistently: Its access decision determines when callers can use the workspace.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: The request retains lifecycle identity and action history after workspace removal.Completed deletion permanently retires the identifier.Restore reapplication removes ledger-listed workspaces that reappear.
Surfaces: apijob
Intent sources: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10services-platform:docs/tenants/tenant-lifecycle-plan.md#§9services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7

Controls

32 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-002 TC-AVL-003 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-DAT-007 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.tenants.deletion-read`	api	global
`hq.tenants.update`	api	global

Business Rules

9 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 9 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	Completed requests store numeric removal totals and the inventory showing no remaining participant data. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved) proved by `ATS-PFM-TNL-018-01`, `TST-PFM-TNL-067`	calculation	service	test services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#records on the request what was removed, and the counts it verified
`02`must prove Confirmed	Requests and notices retain workspace and customer identity, actors, explanations and dates independently of the deleted workspace record. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved) proved by `ATS-PFM-TNL-018-02`	invariant	database	observed services-platform:modules/tenants/db/tenant-deletion-requests.table.ts
`03`must prove Confirmed	Completion also writes a workspace-keyed ledger outside the database with live-removal and backup-expiry times. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Restoring without resurrecting (approved) proved by `ATS-PFM-TNL-018-03`	policy	service	test services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#writes the permanent deletion record outside the database, keyed by the tenant
`04`must prove Confirmed	A completed deletion retires the workspace identifier and creation refuses reuse with the retiring deletion identified. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10 (approved); services-platform:docs/tenants/tenant-identity.md proved by `ATS-PFM-TNL-018-04`, `TST-PFM-TNL-066`	validation	service	test services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to create a tenant again under the id of one that was deleted
`05` Confirmed	Live removal leaves backups to expire within the documented thirty-five-day Production retention period. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D7 (default in force)	policy	service	documented services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 Live deletion is not backup erasure
`06`must prove Confirmed	Restore reapplication disables ledger-listed workspaces that reappear and purges them without another wait or notices; its default mode only reports proposed actions. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 (approved) no proof recorded yet	lifecycle	service	observed services-platform:modules/tenants/services/deletion/reapply-deletions.ts
`07`must prove Confirmed	The product should keep ledger-listed restored workspaces unavailable until deletion is reapplied. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§9 (approved) proved by `ATS-PFM-TNL-018-07`	policy	api	unknown FND-PFM-TNL-004
`08`must prove Confirmed	Immediate deletion refuses without reading or altering the workspace and directs callers to the deletion-request process. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved) proved by `ATS-PFM-TNL-018-05`, `TST-PFM-TNL-057`	policy	api	test services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the tenant exactly as it was, which is the point of refusing
`09` Confirmed	The orphan report reads Platform participant leftovers, missing workspaces behind open requests, returned workspaces behind completed deletions and jobs without a request to follow. origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.3 (approved)	policy	service	observed services-platform:modules/tenants/services/deletion/orphan-report.ts (header)

Scenarios

Id	Given	When	Then	Provenance
`01`	A restore returns a previously deleted workspace.	Staff apply the deletion-ledger recovery process.	The workspace is disabled and purged again with the prior deletion referenced.	observed services-platform:modules/tenants/services/deletion/reapply-deletions.ts
`02`	A returning customer asks for its retired identifier.	Staff submit another workspace request using it.	Creation refuses retirement and requires a different identifier.	documented services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10

Planning

Implementation

Retain deletion evidence and prevent identifier reuse ​

Purpose ​

How It Works ​

Relationships ​