---
id: WF-PFM-TNL-007
title: Open an initial load and activate it
trigger: Bracket initial import with a recorded loading entry and separate activation authority.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1, §12.2 steps 2, 8 and 10 (D5, Andrew
  2026-10-11)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-TNL-011
- CAP-PFM-TNL-005
moves:
- STATE-PFM-TNL-001
- STATE-PFM-TNL-003
crosses:
- SVC-PFM-TNL-tenants
- SVC-PFM-SEC-security
idempotency: Repeated entry while loading preserves the opening record; repeated activation succeeds for an active
  workspace with that record. A new entry after activation replaces it.
concurrency: Entry and activation lock the workspace, but activation does not inspect reset jobs. Existing requests
  can continue using cached availability facts.
hops:
- n: 1
  actor_or_service: Platform API (enterHqTenantLoading)
  action: Authorize the staff loading action on an HQ record route outside the workspace availability gate.
  anchor: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:enterHqTenantLoading
  seam: sync
  on_failure: Refuse missing authority.
  left_inconsistent: The workspace is unchanged.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts
- n: 2
  actor_or_service: Workspace lifecycle
  action: Lock the workspace and open loading only from active implementation standing, recording operator, time
    and reason.
  anchor: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
  seam: sync
  on_failure: Reject standing or successor-table violations.
  left_inconsistent: The refused write retains the earlier workspace state.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading
- n: 3
  actor_or_service: Availability gate
  action: Clear local availability facts so loading restrictions apply in that process.
  anchor: services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf
  seam: sync
  on_failure: Cache clearing has no separate recovery action.
  left_inconsistent: Other warm processes can use cached facts for thirty seconds.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/access/tenant-availability.ts
- n: 4
  actor_or_service: Data Job Engine (outside this module)
  action: Run uploads and imports through the Data Job Engine’s authorized routes.
  anchor: services-platform:modules/data-jobs
  seam: sync
  on_failure: Apply the import engine’s own failure handling.
  left_inconsistent: Committed imported records can require reset.
  observer: Operation response and service logs.
  provenance: documented
  source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2
- n: 5
  actor_or_service: Platform API (activateHqTenant)
  action: Check activation authority independently of import authority.
  anchor: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:activateHqTenant
  seam: sync
  on_failure: Reject an unauthorized activation.
  left_inconsistent: Loading remains open.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts
- n: 6
  actor_or_service: Workspace lifecycle
  action: Lock and activate a loading workspace, retaining status and load facts, then clear local availability.
  anchor: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant
  seam: sync
  on_failure: Refuse unrelated lifecycle states or a never-loaded active workspace.
  left_inconsistent: An open or failed reset does not prevent exposing partial removal.
  observer: Operation response and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant
branches:
- Changing implementation standing to live remains a workspace-administration action.
waits:
- Loading has no automatic expiry.
evidence:
- 'services-platform at ad3f6a65: modules/tenants/aws/api/hq-tenant-loading.routes.ts; services/persistence/tenants.ts;
  services/access/tenant-availability.ts; services/lifecycle/lifecycle-transitions.ts:isTenantEnterableByStaff.'
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Open An Initial Load And Activate It

## What It Does

Bracket initial import with a recorded loading entry and separate activation authority. Repeated entry while loading preserves the opening record; repeated activation succeeds for an active workspace with that record. A new entry after activation replaces it.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  actor Imp as Implementation staff
  actor Lead as Staff with go-live authority
  participant API as Platform staff routes
  participant LC as Workspace lifecycle
  participant DJE as Data Job Engine
  Imp->>API: open the load (reason)
  API->>LC: active and implementation? record and move to loading
  Imp->>DJE: upload and run imports (data-job routes only)
  Lead->>API: activate
  API->>LC: loading -> active, status and record unchanged
```

## When Something Fails

Refuse missing authority. The workspace is unchanged. Reject standing or successor-table violations. The refused write retains the earlier workspace state. Cache clearing has no separate recovery action. Other warm processes can use cached facts for thirty seconds. Apply the import engine’s own failure handling. Committed imported records can require reset. Reject an unauthorized activation. Loading remains open. Refuse unrelated lifecycle states or a never-loaded active workspace. An open or failed reset does not prevent exposing partial removal.

## Open Design Questions

The product should decide reset-related activation safeguards and an abandoned-load removal path. Console loading controls remain unverified.