---
id: CAP-PFM-TNL-012
title: Recover an incorrect initial import
feature: FEAT-PFM-TNL-04
product_area: platform
module: tenant-lifecycle
revision: 2
status: draft
product_intent: proposed
implementation_evidence: partially-observed
supersedes: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa
intent_sources:
  - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§13.3'
  - 'services-platform:docs/data-jobs/tenant-reset.md#§1'
  - 'services-platform:docs/data-jobs/tenant-reset.md#§2'
  - 'services-platform:docs/data-jobs/tenant-reset.md#§3'
purpose: >-
  A reset clears the classified import data so staff can load a corrected
  package into the same workspace.
outcomes:
  - Reset follows the declared removed-and-kept participant classifications.
  - Eligibility and support checks precede removal.
  - A settled interrupted reset can be completed by a fresh request.
concepts:
  - CON-PFM-TNL-004
  - CON-PFM-TNL-003
actors:
  - ACT-PFM-040
  - ACT-PFM-012
surfaces:
  - console
  - api
  - job
preconditions: []
postconditions: []
permissions:
  - key: hq.data-runs.manage
    where_checked: api
    scope: global
rules:
  - id: BR-CAP-PFM-TNL-012-01
    proved_by: [ATS-PFM-TNL-012-01, TST-PFM-TNL-049]
    statement: >-
      Reset requires import authority and refuses activation-only staff,
      customer administrators and anonymous callers.
    kind: permission
    enforced_at:
      - api
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses
      the staff member who may only activate a tenant, resetting being part of
      running the import
    origin: >-
      services-platform:docs/data-jobs/tenant-reset.md#§1 (approved plan DJE
      §16)
  - id: BR-CAP-PFM-TNL-012-02
    proved_by: [ATS-PFM-TNL-012-02]
    statement: >-
      Reset checks implementation status and loading lifecycle at request, job
      creation and each batch, rejecting either mismatch with an explanation.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
      a tenant that is not loading, naming that half of the rule
    origin: >-
      services-platform:docs/data-jobs/tenant-reset.md#§1 (Andrew, 2026-10-11;
      DJE D5)
  - id: BR-CAP-PFM-TNL-012-03
    proved_by: [ATS-PFM-TNL-012-03]
    statement: >-
      Reset confirmation must repeat the workspace identifier; missing or
      incorrect text is rejected without supplying the expected answer.
    kind: validation
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
      a confirmation that is not the tenant’s id, and does not say what to type
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§1 (approved)'
  - id: BR-CAP-PFM-TNL-012-04
    proved_by: [ATS-PFM-TNL-012-04]
    statement: >-
      An open reset prevents another reset request and the refusal identifies
      the existing job before participant work.
    kind: validation
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
      the second request as a conflict, naming the job that is running
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§1 TenantResetRunning'
  - id: BR-CAP-PFM-TNL-012-05
    proved_by: [ATS-PFM-TNL-012-05]
    statement: >-
      Unsupported reset declarations or missing required participants stop reset
      planning before any removal.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#removes
      nothing at all: a half-reset tenant is the outcome worth refusing for
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§3.1 (approved)'
  - id: BR-CAP-PFM-TNL-012-06
    proved_by: [ATS-PFM-TNL-012-06]
    statement: >-
      Reset removes the classified import records, numbering, crosswalks, files
      and search data while preserving records assigned to kept participants.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#keeps
      every table of every participant it does not empty, row for row
    origin: >-
      services-platform:docs/data-jobs/tenant-reset.md#§2 What goes and what
      stays
  - id: BR-CAP-PFM-TNL-012-07
    proved_by: [ATS-PFM-TNL-012-07, ATS-PFM-TNL-012-11]
    statement: >-
      CRM reset batches removal, clears applicable seed entries and reapplies
      defaults; other applications follow their own reset classifications.
    kind: invariant
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-crm:modules/tenant-lifecycle/tests/integration/services/participants/reset.integration.spec.js#leaves
      the tenant holding exactly what a freshly provisioned tenant holds, table
      for table
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§3.4 (approved)'
  - id: BR-CAP-PFM-TNL-012-08
    proved_by: [ATS-PFM-TNL-012-08]
    statement: >-
      Reset returns a recorded job promptly, reports participant removals and
      leaves the workspace loading in implementation.
    kind: lifecycle
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves
      the tenant loading and in implementation, so the package can be loaded
      again at once
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§4 (approved)'
  - id: BR-CAP-PFM-TNL-012-09
    proved_by: [ATS-PFM-TNL-012-09, TST-PFM-TNL-087]
    statement: >-
      After a failed reset settles, another reset request finishes the remaining
      removal without finding records already emptied.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#finds
      nothing left to remove of the participants the first reset had already
      emptied
    origin: 'services-platform:docs/data-jobs/tenant-reset.md#§1 recovery (approved)'
  - id: BR-CAP-PFM-TNL-012-10
    proved_by: []
    statement: >-
      The product should allow reset only when revision history shows no writes
      from sessions outside the import engine.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: unknown
    source: FND-PFM-TNL-019
    origin: >-
      services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§13.3
      (approved 2026-10-12)
  - id: BR-CAP-PFM-TNL-012-11
    proved_by: []
    statement: >-
      CRM suppresses change-event capture throughout reset, including its
      reseeding work.
    kind: policy
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-crm:modules/tenant-lifecycle/tests/integration/services/participants/reset.integration.spec.js#records
      no change event at any point in the run, not even while the records are
      being removed
    origin: none
scenarios:
  - id: SC-CAP-PFM-TNL-012-01
    given: A load assigned chapters to incorrect regions.
    when: The operator confirms the workspace identifier and requests reset.
    then: >-
      CRM records are emptied and defaults restored while kept access records
      and the upload remain; loading continues.
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#empties
      what the other macroservice held for the tenant, by its reset and never
      its purge
edge_cases: []
constraints: []
depends_on:
  - CAP-PFM-TNL-011
  - CAP-PFM-TNL-007
related:
  - CAP-PFM-TNL-008
  - CAP-PFM-TNL-017
journeys:
  - JNY-PFM-TNL-003
open_questions: []
evidence:
  - >-
    Inspected source:
    services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§13.3
  - 'Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1'
  - 'Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§2'
  - 'Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§3'
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses
    the staff member who may only activate a tenant, resetting being part of
    running the import
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1
    (approved plan DJE §16)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
    a tenant that is not loading, naming that half of the rule
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1
    (Andrew, 2026-10-11; DJE D5)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
    a confirmation that is not the tenant’s id, and does not say what to type
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1
    (approved)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses
    the second request as a conflict, naming the job that is running
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1
    TenantResetRunning
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#removes
    nothing at all: a half-reset tenant is the outcome worth refusing for
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§3.1
    (approved)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#keeps
    every table of every participant it does not empty, row for row
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§2 What
    goes and what stays
  - >-
    Inspected source:
    services-crm:modules/tenant-lifecycle/tests/integration/services/participants/reset.integration.spec.js#leaves
    the tenant holding exactly what a freshly provisioned tenant holds, table
    for table
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§3.4
    (approved)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves
    the tenant loading and in implementation, so the package can be loaded again
    at once
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§4
    (approved)
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#finds
    nothing left to remove of the participants the first reset had already
    emptied
  - >-
    Inspected source: services-platform:docs/data-jobs/tenant-reset.md#§1
    recovery (approved)
  - >-
    Inspected source:
    services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§13.3
    (approved 2026-10-12)
  - >-
    Inspected source:
    services-crm:modules/tenant-lifecycle/tests/integration/services/participants/reset.integration.spec.js#records
    no change event at any point in the run, not even while the records are
    being removed
  - >-
    Inspected source:
    services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#empties
    what the other macroservice held for the tenant, by its reset and never its
    purge
controls: [TC-AVL-001, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
exercised_by: [FAS-PFM-TNL-04-01, FAS-PFM-TNL-04-02, FAS-PFM-TNL-04-03, FAS-PFM-TNL-04-04, FAS-PFM-TNL-04-05]
suites: [TST-PFM-TNL-049, TST-PFM-TNL-087]
---

# Recover an incorrect initial import

## Purpose

A reset clears the classified import data so staff can load a corrected package into the same workspace.

## How It Works

The operator confirms the workspace identifier before requesting reset. Rhythm requires implementation mode and loading lifecycle. It also rejects a second open reset and checks remote support before removing data. The recorded job drives participant batches and reports their removal totals. Selected records, crosswalks, numbering, files and derived search data are emptied. Kept participants preserve their records, including the workspace and access setup. CRM restores its defaults after removal; other applications retain or remove configuration according to their own classifications. The workspace stays loading throughout. A failed attempt can be followed by a fresh reset once it settles. The proposed protection against non-engine writes remains an unresolved implementation gap.

## Relationships

- Control the initial import and subsequent opening: Its result establishes the state or declared resources needed by this operation.
- Account for each application’s lifecycle responsibilities: Its result establishes the state or declared resources needed by this operation.
- Apply defaults without undoing customer choices: Its seed ledgers preserve customer choices during lifecycle replay.
- Remove declared workspace resources and verify the result: Its batches and inventory determine the removal result.