---
id: WF-PFM-TNL-008
title: Empty a loading workspace with a reset
trigger: Remove classified initial-load data through a bounded reset job.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/data-jobs/tenant-reset.md#§1–§4 (Andrew 2026-10-11; DJE D5, §13.3)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf
  services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c
  services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa
implements:
- CAP-PFM-TNL-012
- CAP-PFM-TNL-007
moves:
- STATE-PFM-TNL-003
crosses:
- SVC-PFM-TNL-tenants
- SVC-PFM-TNL-crm-tenant-lifecycle
- SVC-PFM-TNL-committees-tenant-lifecycle
- SVC-PFM-TNL-membership-tenant-lifecycle
- SVC-PFM-TNL-marketing-tenant-lifecycle
idempotency: Only one reset can remain pending or running. A new reset after failure revisits removal; application-specific
  retained or reseeded configuration affects the result.
concurrency: Submission locks and rechecks the workspace and open reset. Every removal batch rechecks standing,
  but concurrent import writes have no global serialization established here.
hops:
- n: 1
  actor_or_service: Platform API (resetHqTenant)
  action: Check import authority and map reset confirmation and reason.
  anchor: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:resetHqTenant
  seam: sync
  on_failure: Refuse invalid boundary input.
  left_inconsistent: No reset work starts.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts
- n: 2
  actor_or_service: Reset request
  action: Require loading implementation standing, exact identifier confirmation and no open reset.
  anchor: services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset
  seam: sync
  on_failure: Reject the request before participant work.
  left_inconsistent: The workspace retains its existing records.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts:requireResettableTenant
- n: 3
  actor_or_service: Reset request
  action: Build the live reset plan and check remote reset declarations.
  anchor: services-platform:modules/tenants/services/reset/reset-tenant.ts:resetPlan
  seam: sync
  on_failure: Reject missing classification or unsupported remote reset.
  left_inconsistent: No removal occurs during plan validation.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts:requireRemoteResetSupport
- n: 4
  actor_or_service: Reset request
  action: Lock and recheck the workspace, create the planned reset job and start it after commit.
  anchor: services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset
  seam: sync
  on_failure: Roll back creation on refusal; shared recovery handles a failed start.
  left_inconsistent: A pending job can have no execution.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/reset-tenant.ts
- n: 5
  actor_or_service: Reset job
  action: Recheck standing, remove one participant batch, record counts and advance the stored cursor on completion.
  anchor: services-platform:modules/tenants/services/reset/tenant-reset-operations.ts:tenantResetOperations
  seam: state_machine
  on_failure: Retry eligible errors; refuse blocked work, bounds or changed standing.
  left_inconsistent: Partial removal remains and progress accounting can lag a committed batch.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-operations.ts
- n: 6
  actor_or_service: Remote reset (CRM)
  action: Run CRM’s classified removal with change capture disabled and restore its declared defaults as required.
  anchor: services-crm:modules/tenant-lifecycle/services/participants/reset-batches.ts
  seam: sync
  on_failure: Return participant failure to reset-job handling.
  left_inconsistent: CRM can be partially emptied before restoration finishes.
  observer: Job progress and service logs.
  provenance: observed
  source: services-crm:modules/tenant-lifecycle/services/persistence/tenant-resets.ts
- n: 7
  actor_or_service: Reset job (finish)
  action: Finish the reset with totals and local cache clearing.
  anchor: services-platform:modules/tenants/services/reset/tenant-reset-operations.ts:tenantResetOperations
  seam: state_machine
  on_failure: Retry task failure under the workflow policy.
  left_inconsistent: Earlier removed data is not restored by job failure.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts
branches:
- The reset retains Commerce, Submissions, Accounting and Websites.
- Committees and Marketing do not reseed; Membership retains configuration and ledger context.
waits:
- The workflow permits at most three thousand batches before a new recovery request is needed.
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/reset/*.ts; services/lifecycle/reset-participants.ts;
  db/tenant-reset-jobs.table.ts; docs/data-jobs/tenant-reset.md.'
- 'services-crm at a8d1364f: modules/tenant-lifecycle/services/participants/reset-batches.ts; services/persistence/tenant-resets.ts.'
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Empty A Loading Workspace With A Reset

## What It Does

Remove classified initial-load data through a bounded reset job. Only one reset can remain pending or running. A new reset after failure revisits removal; application-specific retained or reseeded configuration affects the result.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  actor Staff as Implementation staff
  participant API as Platform staff route
  participant Req as Reset request
  participant Job as Reset job
  participant PFM as Platform participants
  participant Apps as CRM, Committees, Membership, Marketing
  Staff->>API: reset (identifier typed back, reason)
  API->>Req: state, confirmation, no open reset
  Req->>Apps: describe (reset declared?)
  Req->>Req: record job with plan (locked recheck)
  Req-->>Staff: accepted, job
  loop each participant at the cursor, one batch per call
    Job->>Job: still loading in implementation?
    alt Platform participant
      Job->>PFM: reset or purge batch
    else other application
      Job->>Apps: reset batch
    end
  end
  Job->>Job: settle with totals
```

## When Something Fails

Refuse invalid boundary input. No reset work starts. Reject the request before participant work. The workspace retains its existing records. Reject missing classification or unsupported remote reset. No removal occurs during plan validation. Roll back creation on refusal; shared recovery handles a failed start. A pending job can have no execution. Retry eligible errors; refuse blocked work, bounds or changed standing. Partial removal remains and progress accounting can lag a committed batch. Return participant failure to reset-job handling. CRM can be partially emptied before restoration finishes. Retry task failure under the workflow policy. Earlier removed data is not restored by job failure.

## Open Design Questions

The approved check for non-import writes before reset is absent. Application restoration policies differ, and reset failure has no separate notification.