---
id: ADR-PFM-TNL-012
title: Classified Initial-Load Reset
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf
  services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c
  services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa
decision: Reset only a loading implementation workspace using classified removal participants, and verify remote
  reset support before recording destructive work.
constrains:
- DOM-PFM-TNL-004
- STATE-PFM-TNL-003
- WF-PFM-TNL-008
- SVC-PFM-TNL-tenants
- SVC-PFM-TNL-crm-tenant-lifecycle
- SVC-PFM-TNL-committees-tenant-lifecycle
- SVC-PFM-TNL-membership-tenant-lifecycle
- SVC-PFM-TNL-marketing-tenant-lifecycle
origin: services-platform:docs/data-jobs/tenant-reset.md#§1–§3 (Andrew 2026-10-11); services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§13.3
alternatives:
- option: Restore the cluster to before the import
  why_not: A shared cluster restore would affect unrelated workspaces.
- option: Delete and rebuild the workspace
  why_not: Rebuilding would discard identity, access and upload context needed for another import.
- option: Write a separate reset per application
  why_not: A second independent removal implementation would duplicate purge responsibilities.
consequences:
- Every Platform participant needs an emptied-or-retained classification.
- Application reset policies restore different amounts of configuration.
- Failure requires another reset request and has no separate requester notice.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/reset/*.ts; services/lifecycle/reset-participants.ts;
  docs/data-jobs/tenant-reset.md.'
---

# Classified Initial-Load Reset

## Context

An incorrect initial import needs a workspace-specific recovery path that retains identity and access configuration. Reset behavior differs from complete deletion.

## Decision

Reset only a loading implementation workspace using classified removal participants, and verify remote reset support before recording destructive work.

## Alternatives Considered

Restore the cluster to before the import: A shared cluster restore would affect unrelated workspaces. Delete and rebuild the workspace: Rebuilding would discard identity, access and upload context needed for another import. Write a separate reset per application: A second independent removal implementation would duplicate purge responsibilities.

## Consequences

Every Platform participant needs an emptied-or-retained classification. Application reset policies restore different amounts of configuration. Failure requires another reset request and has no separate requester notice.