--- id: CON-PFM-TNL-004 name: Initial Data Load feature: FEAT-PFM-TNL-04 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa definition: >- Initial loading is the recorded import period during which staff prepare customer data and decide when to reopen the workspace. owned_by: MOD-PFM-TNL synonyms: - loading - initial import - reset and reload not_to_be_confused_with: - workspace construction - live business standing - complete deletion facets: - name: Loading state meaning: >- The lifecycle marks the protected import period. Its database constraints require implementation mode and a recorded operator and opening time. used_for: Bracketing the protected import period. - name: Load record meaning: >- The accountable opening survives repeated requests and later activation. Its explanation is short enough to support operational review. used_for: Retaining the explanation of how loading began. - name: Reset work meaning: >- A durable job removes selected records in batches. It preserves workspace identity and the access setup classified as kept. used_for: Recovering after an incorrect package or mapping. - name: Reset classification meaning: >- Platform distinguishes removed and kept participants. CRM restores defaults after removal, Membership retains selected configuration and Committees currently removes without reseeding. The resulting workspace cannot universally be described as identical to fresh provisioning. used_for: Distinguishing retained setup from reset data. - name: Activation meaning: >- A separate permission controls the decision to end loading. The service preserves business status and accepts an already completed activation of the recorded load without repeating its effect. used_for: Recording the separate readiness decision. relationships: - to: CON-PFM-TNL-001 statement: Loading and activation change availability through workspace lifecycle. provenance: observed source: >- services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant - to: CON-PFM-TNL-003 statement: Reset reaches the application participants selected by classification. provenance: observed source: 'services-platform:modules/tenants/services/reset/reset-tenant.ts' lifecycle: - state: loading meaning: Customer-context use is restricted while import continues. how_it_changes: Reset can start over; activation ends loading. - state: resetting meaning: The reset job removes selected data within the loading period. how_it_changes: Completion permits another load; failure can require a fresh reset. - state: activated meaning: Loading has ended without a business-status change. how_it_changes: Staff make any later live-status decision separately. acted_on_by: - CAP-PFM-TNL-011 - CAP-PFM-TNL-012 visible_to: - ACT-PFM-040 - ACT-PFM-041 - ACT-PFM-039 evidence: - >- Inspected source: services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant - >- Inspected source: services-platform:modules/tenants/services/reset/reset-tenant.ts supersedes: [] intent_sources: - >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12 (approved 2026-10-12) --- # Initial Data Load ## What It Is An initial data load is the protected period in which staff bring a customer’s existing records into an implementation workspace. Construction has already supplied the workspace and baseline resources. Loading supplies the customer’s own information, and the lifecycle records when staff opened that work. The workspace remains the same workspace throughout corrections and retries. This period separates importing records from deciding that the customer can begin using them. An import operator can prepare and replace data, while activation authority decides that the result is ready to open. The load record retains the operator, opening time and explanation after activation, allowing later support to understand how the workspace reached its current state. ## What It Is Not Loading is not provisioning and does not create the customer’s workspace identity. It is also different from live business status. Activation ends loading but leaves implementation status unchanged; staff can choose live standing separately. Reset is not complete workspace deletion or a general undo command. It follows explicit participant classifications. Records retained by that classification survive even if they were created during implementation, while selected records are removed regardless of the operator’s informal understanding of ownership. ## How It Is Used The operator opens loading only for an active implementation workspace. Ordinary customer routes then close, with data-job routes available for import and authorized staff system access retained. The import engine and package handling belong to their own module. If a mapping or package is wrong, staff confirm the workspace identifier and request reset. The recorded job reports removal by participant. A successful reset leaves loading open for another package. An interrupted reset can be followed by a fresh request after the first settles. When the data is ready, a caller with activation authority returns the workspace to active lifecycle. ## Its Facets **Loading state.** The lifecycle marks the protected import period. Its database constraints require implementation mode and a recorded operator and opening time. **Load record.** The accountable opening survives repeated requests and later activation. Its explanation is short enough to support operational review. **Reset work.** A durable job removes selected records in batches. It preserves workspace identity and the access setup classified as kept. **Reset classification.** Platform distinguishes removed and kept participants. CRM restores defaults after removal, Membership retains selected configuration and Committees currently removes without reseeding. The resulting workspace cannot universally be described as identical to fresh provisioning. **Activation.** A separate permission controls the decision to end loading. The service preserves business status and accepts an already completed activation of the recorded load without repeating its effect. ## How It Relates Workspace lifecycle controls when loading can begin and what requests remain available. Participants supply reset work and define the application resources affected. Provisioning precedes the load, while deletion is a different decision with its own waiting period and irreversible boundary. Data Runs own execution of the import itself rather than this module’s loading bracket. ## What It Could Become The product should implement the recorded safeguard against reset after non-engine writes. Authorized staff access makes route closure insufficient to establish that safeguard on its own. Product also needs a deliberate exit for abandoned loading workspaces and a shared explanation of which configuration each application preserves or restores.