Tenant lifecycle

Hubs and spokes both go through the same six-state machine.

States

State	What it means
provisioning	Helm release is rolling out. Database, PVC, and pod are coming up. Not reachable yet.
running	Healthy and serving traffic. The expected steady state.
updating	A Helm upgrade is in progress (chart bump, size change, mode change). Traffic continues; brief blips possible.
paused	Deployment is scaled to zero. No traffic, no compute cost — but the database and PVC remain. Reversible.
degraded	Pod is up but unhealthy (failing probes, OOM loops, image pull errors). Operator attention warranted.
maintenance	Operator-flagged. Used during planned work; the portal hides the tenant from end-users.

Deletion isn't a state — it removes the row, the namespace, the database, and the PVC. There's no "deleted" tombstone after the fact.

Transitions

                  (request approved)
   request ──────────────────────────┐
                                     ▼
   ┌────── provisioning ───── running ◀────────┐
   │            │                │              │
   │            ▼                ▼              │
   │       (helm fail)        updating ─────────┘
   │            │                │
   │            ▼                ▼
   │        degraded ◀──────► paused
   │            │
   │            ▼
   └────►  destroyed (row + namespace gone)

A few rules the system enforces:

• Provisioning is async. The POST returns 201 with a row in provisioning; subscribe to events for the transition to running (or degraded if it fails).
• paused ↔ running is reversible without data loss.
• Destruction is async too — the DELETE returns 202 and Helm tears down in the background. Subscribe to events for the SpokeUpdateRemoved notification before assuming the namespace is gone.

What customers see

Customer signal	Means
Spoke shows "Provisioning…"	Helm release in flight. Wait.
Spoke shows green dot	running. Click through to use.
Spoke shows amber dot + "Maintenance"	Operator is doing planned work. Try later.
Spoke shows red dot	degraded — operator should already know; if you're seeing this for >15 min open a ticket.
Spoke disappears from the list	Either deleted or you lost access (delegation revoked). The audit trail will say which.

What automation sees

GET /api/spokes/:id returns the row's status. Don't poll — subscribe to the federation events stream (GET /api/federations/:id/events) for transitions. Polling the row works but burns request budget.