---
id: WF-PFM-SEC-002
title: Open, reset and activate an initial load
trigger: Migration staff open an initial load, request a reset after an unsuitable import, or activate the
  prepared workspace.
product_area: platform
module: security
revision: 1
status: draft
design_intent: confirmed
origin: The Data Job Engine plan §12.1, §12.2, §13.3 (loading and reset only from implementation and loading,
  Andrew 2026-10-11); services-platform:docs/data-jobs/tenant-reset.md
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-SEC-003
moves:
- STATE-PFM-SEC-001
crosses:
- SVC-PFM-SEC-tenants
idempotency: Repeated opening or activation preserves the intended lifecycle; record metadata need not be unchanged.
  An open reset blocks another reset. A later reset can safely revisit participant removal after failure because
  each participant reports its remaining work.
concurrency: Reset submission locks and checks the workspace; batches check readiness and business status again.
  Activation prevents later reset batches from deleting active workspace data. Loading permits data-job routes
  and eligible HQ routes, so it is not an exclusive engine-writer lock.
hops:
- n: 1
  actor_or_service: HQ staff (open the load)
  action: Open loading from an active workspace in implementation and retain opening actor, time and reason.
  anchor: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts (enterHqTenantLoading)
  seam: sync
  on_failure: Refuse incompatible lifecycle or business status.
  left_inconsistent: The rejected opening changes no lifecycle.
  observer: The staff caller receives the refusal.
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
- n: 2
  actor_or_service: Workspace availability gate (data-job admission)
  action: Admit data-job routes during loading under the availability exception; import execution belongs to
    its owning engine.
  anchor: services-platform:modules/tenants/services/access/tenant-availability.ts:isDataJobRoute
  seam: sync
  on_failure: The availability gate rejects other ordinary routes; engine-specific failure handling is delegated.
  left_inconsistent: An import can leave partial records for reset.
  observer: Staff inspect the data run through its owning surface.
  provenance: observed
  source: services-platform:modules/tenants/services/access/tenant-availability.ts (header, loading exception)
- n: 3
  actor_or_service: HQ staff (request a reset)
  action: Validate typed identifier, loading/implementation state, participant reset support and absence of
    open reset; persist and then start the job.
  anchor: services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset
  seam: sync
  on_failure: Refuse before deletion if support or state checks fail.
  left_inconsistent: A failed submission removes no data.
  observer: The caller and reset read expose the result.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts (header)
- n: 4
  actor_or_service: Reset job
  action: Execute one participant batch at the cursor until all participants report done, preserving memberships,
    access configuration and the uploaded package.
  anchor: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts (ResetParticipants)
  seam: state_machine
  on_failure: Record job failure and retain loading lifecycle; a later reset can continue removal.
  left_inconsistent: Some participants may be empty while others retain imported data.
  observer: Reset status and the job monitor identify progress and failure.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts (header)
- n: 5
  actor_or_service: Reset job (finish)
  action: Finish with removal totals, logging and local availability invalidation.
  anchor: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts (FinishReset)
  seam: state_machine
  on_failure: Apply the configured task retry policy.
  left_inconsistent: Already completed removal remains committed.
  observer: Job monitoring shows totals and settlement.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts (header)
- n: 6
  actor_or_service: HQ staff (activate)
  action: Activate the loaded workspace without changing business status or first-activation time, then invalidate
    local availability.
  anchor: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts (activateHqTenant)
  seam: sync
  on_failure: Refuse incompatible lifecycle.
  left_inconsistent: A refused activation changes no readiness.
  observer: The caller receives activation success or refusal.
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant
branches:
- Reset submission refuses unsupported remote participants before removing any records.
waits:
- Reset uses short batch invocations with execution/history limits rather than a guaranteed elapsed duration.
evidence:
- 'services-platform at ad3f6a65: modules/tenants/aws/api/hq-tenant-loading.routes.ts; services/reset/*; services/persistence/tenants.ts;
  services/lifecycle/reset-participants.ts; services/access/tenant-availability.ts.'
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Open, reset and activate an initial load

## What It Does

The workflow separates admission to loading, delegated import work, batched reset and staff activation. Its admission hop proves which routes loading permits; it does not claim an import queue implementation.

## The Flow

```mermaid
flowchart TD
    H1["Open loading"]
    H2["Admit data-job routes"]
    H3["Submit reset"]
    H4["Reset participant batches"]
    H5["Finish reset"]
    H6["Activate loaded workspace"]
    H1 --> H2
    H2 -->|staff requests reset| H3
    H3 --> H4
    H4 -->|more batches| H4
    H4 -->|done| H5
    H2 -->|staff activates| H6
    H5 -->|staff activates| H6
```

The diagram separates the relevant success, alternative and failure paths. The numbered hop rows retain the detailed authority checks, delegated work and retry limits.

## When Something Fails

Activation is a staff decision without implemented proof of import completeness. It preserves the first-activation timestamp, leaving the documented planning gap and timestamp question open.

Repeated opening or activation preserves the intended lifecycle; record metadata need not be unchanged. An open reset blocks another reset. A later reset can safely revisit participant removal after failure because each participant reports its remaining work.

Reset submission locks and checks the workspace; batches check readiness and business status again. Activation prevents later reset batches from deleting active workspace data. Loading permits data-job routes and eligible HQ routes, so it is not an exclusive engine-writer lock.

## Open Design Questions

The recorded findings retain any stronger planning expectation, missing writer or unproved recovery path. Observed behavior does not approve those outstanding product choices.