---
id: STATE-PFM-TNL-003
title: Initial load and its resets
object: DOM-PFM-TNL-004
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/data-jobs/tenant-reset.md#§1 When a tenant may be reset (Andrew 2026-10-11; DJE D5)
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
states:
- name: open
  meaning: Loading is open and there is no pending or running reset.
- name: resetting
  meaning: A pending or running reset is removing the classified resources.
- name: reset_failed
  meaning: The latest reset failed while the workspace can remain loading with partial removal.
- name: activated
  meaning: Lifecycle is active again and the latest load-opening facts remain recorded.
transitions:
- from: open
  to: resetting
  trigger: Staff request an initial-load reset.
  guard: The workspace is loading in implementation; identifier confirmation passes, no reset is open and planned
    remote services declare support.
  side_effects:
  - Store reason and participant plan on a new reset job.
  - Start execution after the transaction commits.
  who: Rhythm staff with import authority
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset
- from: resetting
  to: open
  trigger: The reset finishes its stored participant plan.
  guard: Every batch has rechecked loading and implementation standing.
  side_effects:
  - Store removal totals and clear local availability facts.
  who: reset job
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-operations.ts:tenantResetOperations
- from: resetting
  to: reset_failed
  trigger: A reset batch refuses or execution fails.
  guard: A participant blocks, capability or workspace standing changes, or a batch or execution bound is exceeded.
  side_effects:
  - Keep failure information on the job without a separate notice or domain consequence.
  who: reset job or jobs reconciler
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts:ensureTenantResetJobTypeRegistered
- from: reset_failed
  to: resetting
  trigger: Staff submit another reset after failure.
  guard: The prior job is terminal and the ordinary submission conditions pass.
  side_effects:
  - Create a new job that revisits the stored removal plan.
  who: Rhythm staff with import authority
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset
- from: open
  to: activated
  trigger: Staff activate a load with no reset running.
  guard: The workspace lifecycle is loading.
  side_effects:
  - Return lifecycle to active without changing business standing or load facts.
  who: Rhythm staff with go-live authority
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant
- from: resetting
  to: activated
  trigger: Staff activate while a reset remains open.
  guard: Activation checks loading but does not inspect reset standing.
  side_effects:
  - Open the workspace; a later reset batch can refuse on the changed lifecycle.
  who: Rhythm staff with go-live authority
  provenance: inferred
  source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant (no reset check);
    services/reset/tenant-reset-operations.ts
- from: activated
  to: open
  trigger: Staff open loading again after activation.
  guard: The workspace is active and remains in implementation.
  side_effects:
  - Replace the previous load-opening facts with the new operator, time and reason.
  who: Rhythm staff with import authority
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
- from: reset_failed
  to: activated
  trigger: Staff activate after reset failure.
  guard: Lifecycle is loading; the reset failure is not a refusal condition.
  side_effects:
  - Open the workspace with whatever records the reset left.
  who: Rhythm staff with go-live authority
  provenance: inferred
  source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant (no reset check)
invalid:
- from: activated
  to: resetting
  why: A reset is refused unless the workspace is loading; people may already be working in it.
- from: resetting
  to: resetting
  why: A second reset while one is open is refused by name and by the database.
concurrency: Reset creation rechecks the locked workspace, and each batch checks it again. Activation can race reset,
  making later batches refuse while exposing partial removal. The product should decide whether activation needs
  an additional reset safeguard and how to handle writes already in flight.
invariants:
- INV-DOM-PFM-TNL-004-01
- INV-DOM-PFM-TNL-004-02
- INV-DOM-PFM-TNL-004-03
- INV-DOM-PFM-TNL-004-04
- INV-DOM-PFM-TNL-004-05
evidence:
- 'services-platform at ad3f6a65: modules/tenants/aws/api/hq-tenant-loading.routes.ts; services/persistence/tenants.ts;
  services/reset/*.ts; db/tenant-reset-jobs.table.ts.'
---

# Initial Load And Its Resets

## The Lifecycle

```mermaid
stateDiagram-v2
  [*] --> open: load opened on an active implementation workspace
  open --> resetting: reset requested
  resetting --> open: reset finished
  resetting --> reset_failed: reset refused or exhausted
  reset_failed --> resetting: reset requested again
  open --> activated: go-live authority activates
  resetting --> activated: activation not refused
  reset_failed --> activated: activation not refused
  activated --> open: loaded again while still in implementation
  activated --> [*]
```

## Transitions Explained

This model combines workspace loading with reset-job standing; these labels are a projection rather than one stored enum. A reset stores its participant plan, removes resources in batches and leaves loading open on success. Failure retains partial removal, and recovery submits another reset. Activation ends loading independently of reset-job standing.

## What Cannot Happen

Reset admission requires loading and implementation and permits only one pending or running reset. Activation is possible during or after failed reset because it checks no reset record. A later loading entry can replace the earlier opening facts on an active implementation workspace.

## Concurrency and Timing

Reset creation rechecks the locked workspace, and each batch checks it again. Activation can race reset, making later batches refuse while exposing partial removal. The product should decide whether activation needs an additional reset safeguard and how to handle writes already in flight.